Reduce use of javascript: URLs to avoid CSP issues

IE6/7 needs "javascript:" as the iframe src to avoid an HTTPS warning, but modern browsers (or at least Chrome 40) will complain about such URLs if there is a strict Content-Security-Policy.

These changes resolve the following error I am getting in a Chrome extension: "Refused to execute JavaScript URL because it violates the following Content Security Policy directive: "script-src 'self' chrome-extension-resource:". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution."

I have not tested this change in other browsers.