Changed from single altcha script tag to individual files in popup html. This eliminates the need for a blob: source in the content security policy

made some teaks to manifest validation issues.