CSP: Move off inline JavaScript

[Abbe98]

We want to allow stricter Content security policies and therefore move away from using inline JavaScript.