FF CSP fix: posted GUIs now hosted by httpserver (with horrible, mustchange hack)