Re: Content Security Policy without unsafe-inline

[Lance Java]

I hate both ideas!

Encoding in the URL means a useless request and will have issues with
maximum url length.

A token requires serverside state and relies on some form of time to live.