Fold the private data-hx-* vocabulary into the dispatcher's verbs
audit Run 15 Phase 5: CSP script-src drops 'unsafe-inline'