Remove layouts/support.html (this leftover from codingrobots.com)
Get rid of most of inline JavaScript.

This is a work-in-progress to remove 'unsafe-inline' from
Content-Security-Policy.

Still left:

 - pages/password/ and pages/password2/

   We need to exclude these locations from CSP, because they are
   one-file HTML+JS things, which use inline JS.

 - Google Analytics:

   While in a separate JS file (assets/js/google-analytics.js), it still
   loads external JS by putting "<script>" into DOM, which is not
   allowed with CSP if we remove 'unsafe-inline'. We could just do
   <script src="https://www.google-analytics.com/analytics.js"></script>
   but we load Analytics conditionally, dynamically, to be able to
   exclude it from localhost (not important) and .onion domains.
   We should figure out how to statically exclude it from .onion without
   having two copies of the website for .biz and .onion.
Update jQuery v1.11 to v1.11.1.
Use /maybe-google-analytics.js to either redirect to real Google
Analytics for .biz or return empty file for .onion. This way
we "dynamically" load Google Analytics for different domains, but
without any inline JavaScript. This allows us to remove 'unsafe-inline'
Content Security Policy (we did).