Remove unsafe-inline CSP setting.

[zorbathut]

This implies that we remove all of our inline javascript into functions (or other various uglier solutions; let's just do that.)

Doing the whole thing might be hard, but if you're reading this because of the Simple tag, just getting started on it won't be hard; do the easy stuff and let someone know the easy stuff is done!