Version 0.39.3

Narrowed the Content Security Policy so that script written straight into the markup cannot run.

A Content Security Policy is the rule a site hands the browser up front, saying what it may run and where it may connect. One kind of script — the sort written into an element as an attribute — was still permitted here, and that is the shape injected code reaches for first, so it is now refused outright. The other kind stays permitted: NMTS draws its pages ahead of time, and the scripts that put those pages on screen are inline, so refusing them would leave nothing to show. And the policy travels to you through the company that relays the connection, which means it is not what protects you from that company — this change guards against a future mistake in NMTS's own code.