* add disclaimer about changing the script
* add hash for obsolete browser script
* add explicit domain img-src
* add single quotes
* add quotes to `data:`
* change order and remove single quotes
* lint, remove extra slash, and make hash an array
* add links to S3
* surround script has in single quotes