Re: Content Security Policy without unsafe-inline

[Lance Java]

> Well, we would solve the original request and Tapestry would be able to
tell it's optionally CSP-compliant out of the box

I'm not sure that it would be CSP compliant since I'm sure there's an
eval() in the js somewhere for ajax responses.