more content security work

remove inline script