Fix support on strict CSP and fix page visibility

Previously, Browser Ponies will not work properly on web pages with strict Content Security Policy because it was creating/eval() new functions on the fly. (http://www.html5rocks.com/en/tutorials/security/content-security-policy/ )

This commit fixes so that "new Function()" is no longer needed.

One side effect is that event listeners must be functions, it cannot be strings, so this means 

return tag('img', {onmousedown: 'return false'});

must be changed to

return tag('img', {onmousedown: function() {return false;}});

The page visibility function has also been tweaked a bit, previously webkitvisibilitychange and visibilitychange would both fire on new versions of Chrome, leading to some weird funkiness.
Also removed oHidden and ovisibilitychange as it's not needed: http://caniuse.com/pagevisibility

Demo with CSP: https://little.my/tests/bp-csp/