Re: Content Security Policy without unsafe-inline

[Lance Java]

> Reading the linked Wikipedia article, that's the only solution I can
think of. I think it could be done with just a couple changes and a new
Dispatcher.

It's tricky because there would be 2 requests (1 for markup and 1 for
javascript).