Moving Duo.Init to Duo-Init.js so script-src 'unsafe-inline' is not required in a site's Content Security Policy