Enhancement: Content Security Policy support

[patrick-steele-idem]

Currently, Marko Widgets renders inline <script> tags on the server, uses eval() and it uses inline styles in a few places. Inline script and styles are not allowed with a strict CSP unless they tags are whitelisted using a nonce attribute. Also, eval() is currently used to parse sanitized JSON data sent from the server for performance reasons, but in CSP mode we should use JSON.parse().

Related issue for Lasso.js: lasso-js/lasso#93

[maberer]

For further information on this specific topic, #27 should be considered related to this issue.

[patrick-steele-idem]

Doh. Thanks for the reminder @tindli :)