closed security breach using a little hack

csp meta tag is inserted before the plugin html string to prevent
attack vectors like uncommenting the csp…
This creates invalid html, which is then inserted into <head> by the
browser, making the whole page secure.

If the browser should change this behavior, the app will become
insecure!