inject stripe public key in a data attribute instead of unsafe-inline