Make it possible to set CSP nonce values in configuration

[janxious]

currently inline scripts will fail nonce checks for content security policy if they are required for inline scripts, should be able to set this from a config or possible env variable.