Make compatible with secure Content-Security-Policy

[junowilderness]

A reasonable Content-Security-Policy sets 'script-src' to 'self', which blocks inline JavaScript. This module currently uses inline JavaScript for the refresh feature.

[Olaf1989]

@Gregwar @cilefen I also ran into the Content-Security-Policy story. It seems good to me to implement this, some minor updates will have to be adjusted for this. Hopefully I will have some time soon to submit a new pull request for this (unless someone else has time for this).

[junowilderness]

This is a bit "much" but this is how SF excepts the profile toolbar.

[Olaf1989]

@cilefen that is a nice solution, but I think this is, indeed, a bit too big for the small piece of javascript code what matters to us.