confusing my code with my note pad
Strict CSP header. Locals available to extensions.

I removed all inline javascript scripts, which allows a strict content security policy.

All locals (JS variables set by the server for the page) are now defined in a script element with mime type `Application/JSON` and don't pollute the global scope any more as they're loaded in the `locals` miaou module (e.g. `miaou.locals.room`).

A Chrome extension can now access those variables using the below code :

	var locals = JSON.parse($('#locals').html());
SO boxer now preserves sharing urls (so that clicking increments SO publicizing counter)
Merge branch 'csp'