+ add optional CSP nonce to allow inline script compliance

[slorg1]

Surgical updates to comply with basic CSP. This allows the required inline script for this django extension to run in a safe way.

If django CSP is not installed: everything works seamlessly :smile_cat:

Note: this PR does not cover inline styles but the styles do not block the functionality, only the scripts did.