Remove unsafe inline

The current simple demo uses inline javascript that would require a server's Content-Security-Policy to include "script-src 'unsafe-inline'". This change moves the Duo.init code to a separate JavaScript file which which removes the need for inline JavaScript in index.php.