removed inline <script> tags from /views/ ; implemented CSP with the default option