Tighten the Content-Security-Policy

[jcjones]

Once #61 merges, the Content Security Policy can have the plot.ly entries removed.

Further, the Google Analytics code can be relocated out of the main templates into main.js to permit removal of the unsafe-inline CSP script source.

[jcjones]

See #69 for a suggested new CSP policy:

Content-Security-Policy "default-src 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-eval' 'self' https://www.google-analytics.com; img-src 'self' data: https://www.google-analytics.com;"

[danjeffery]

These have been merged and further tweaks have been made since #69. I believe this is complete.