No unsafe-inline, no inline scripts, and both Chrome + Firefox will pass CSP checks.
Moved all inline <script> codes to a separate popup.js file