.text() was decoding HTML entities, read raw script node content for CSP

Fixes #31