Eliminate CSP violations in runtime.js.

Closes #112.