removing inline JavaScript from tests/index.html & adding CSP to the test server

As outlined in #65, we can just fix the inline bits in JS. It seems that Mocha/Chai don't introduce any other CSP breakage :)