Use link-to helper instead of hardcoded href
Get rid of Content Security Policy - this is a toy project