Lock the pad's inner-iframe down with CSP

www/pad/inner.html

@@ -7,6 +7,7 @@
     <link rel="stylesheet" href="/bower_components/bootstrap/dist/css/bootstrap.min.css">
     <script async data-bootload="/pad/inner.js" data-main="/common/boot.js?ver=1.0" src="/bower_components/requirejs/require.js?ver=2.1.15"></script>
     <script src="/bower_components/ckeditor/ckeditor.js"></script>
+    <script src="/pad/wysiwygarea-plugin.js"></script>
     <style>
     html, body {
         margin: 0px;