[WIP] First pass on CSP

issue #332

This isn't working properly at the moment, the nonce is not allowing the inline scripts