--csp will now operate on the input html file as well

lib/vulcan.js

@@ -277,9 +277,8 @@ function handleMainDocument() {
     }
     var scripts = [];
     var scripts_after_polymer = [];
-    var tempoutput = cheerio.load(output);
 
-    tempoutput('script').each(function() {
+    var fn = function() {
       var src = this.attr('src');
       if (src) {
         // external script
@@ -293,8 +292,16 @@ function handleMainDocument() {
         // inline script
         scripts.push(this.text());
       }
-    }).remove();
+    };
+
+    // CSPify imports
+    var tempoutput = cheerio.load(output);
+    tempoutput('script').each(fn).remove();
     output = tempoutput.html();
+
+    // CSPify main page
+    $('script').each(fn).remove();
+
     // join scripts with ';' to prevent breakages due to EOF semicolon insertion
     var script_name = path.basename(options.output, '.html') + '.js';
     fs.writeFileSync(path.resolve(options.outputDir, script_name), scripts.join(';' + EOL), 'utf8');