Move inline event handlers to viewer.js to comply with a
Content-Security-Policy where directive "unsafe-inline" is not set.
Change textarea.rows = <number of newlines> to
textarea.style.height = textarea.scrollHeight.
(The former is extremely unreliable; consider long lines...)