[bug 959270] Added allowed domains, commented inline <script> tags. Found a bug with nav.css that loads from login server