[bug959277] - Added CSP in Report-Only mode into goggles.webmaker.org

-> https://bugzilla.mozilla.org/show_bug.cgi?id=959277
Added CSP to goggles.webmaker.org. The only one thing is that - when you click on "Active X-Ray Goggles" CSP catches inline script somewhere, I am not quite sure where. I would really appreciate to get help finding it. 
I have a suggestion: There is a div: 
```
<div class="bookmarklet"><a href="" id="bookmarklet-link" class="ui-btn"><span>{{ gettext("Activate X-Ray Goggles") }}</span></a></div>
```
It has 'id="bookmarklet-link"' , I guess that it could be a cause for that.