Content Security Policy compatibility

[Zankaria]

https://infosec.mozilla.org/guidelines/web_security#content-security-policy

CSP allows to block XSS attacks by preventing the execution of unauthorized javascript or css inside a html page.
While vichan should already be compatible with CSP's basic form, it's not currently possible to set the policy to it's strictest form as vichan's includes inline javascript and stylesheets.

[Zankaria]

Maybe we can use href to still tell main.js which page we're in?
Or maybe a query parameter in the script tag? Can those even be read?

[Zankaria]

Or just this: https://stackoverflow.com/a/15069289/14855239