Don't assume django-csp is being used

[dmptrluke]

Since this project has been more widely-adopted, the assumption that django-csp is being used should be removed from widget.html.

Support for CSP_NONCE should be maintained, but the nonce attribute should not be added to the HTML if CSP_NONCE is not defined in the template.