Allow running with backend CSP enabled

[cundd]

• Store the current left and top values as data-attributes
• Move the inline JavaScript into a file

[lochmueller]

Hey @cundd thank you for the great cleanup/patch. Merged! Release in a few minutes. Regards, Tim

[cundd]

I remembered you mentioning CSP and then had to think about how I could disable it - and thought there may be a better solution :)