rewriting html/js/css to support CSP

> moved inline style and js to different files. merged event handler and non-controller parts out of scanctrl.js to a main.js. added CSP in meta tag. but we have to allow eval/Function because of acorn.js :(

this fixes the first half of #24, for browsers not supporting the `meta` tag CSP (hint: Firefox, currently) we would still need to address hosting.