First pass on CSP

issue #322

This isn't working properly at the moment, the nonce is not allowing the inline scripts