Update how NOnce is added and removed to cached headers

[GeekInTheNorth]

There is a client who is using the module who are finding that the headers being generated for the CMS backend contain a nonce value when these should be omitted for CMS backend routes due to Optimizely code not being optimized to work for NOnce.

Currently the code looks for and replaces/removes a value of ##NONCE## within the CMS with the correctly generated NOnce for the request. It appears as though the generated value may be getting added into the cache.

Suggested solution: instead of caching the headers with an ##NONCE## placeholder, generate it in the format that will normally be used and then regex replace the nonce value for the specific request or regex replace it if it needs to be removed.

Note: I have not been able to reproduce this issue yet.

[GeekInTheNorth]

This turned out to be a case where the Menu Provider was in some builds causing the Start Page to be the active content within the Stott Security Pages.

Changes here include:

• Fixing the Menu Provider
• Ensuring the NONCE attribute is added to the script and style tags on the admin page