diff --git a/bin/templates/project/assets/www/index.html b/bin/templates/project/assets/www/index.html
index e84fbd7c..af4f11c5 100644
--- a/bin/templates/project/assets/www/index.html
+++ b/bin/templates/project/assets/www/index.html
@@ -19,10 +19,11 @@
 -->
 <html>
     <head>
-        <meta charset="utf-8" />
-        <meta name="format-detection" content="telephone=no" />
-        <meta name="viewport" content="user-scalable=no, initial-scale=1, maximum-scale=1, minimum-scale=1, width=device-width, height=device-height, target-densitydpi=device-dpi" />
-        <link rel="stylesheet" type="text/css" href="css/index.css" />
+        <meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: blob: https://ssl.gstatic.com/accessibility/javascript/android/; style-src 'self' 'unsafe-inline'">
+        <meta name="format-detection" content="telephone=no">
+        <meta name="msapplication-tap-highlight" content="no">
+        <meta name="viewport" content="user-scalable=no, initial-scale=1, maximum-scale=1, minimum-scale=1, width=device-width">
+        <link rel="stylesheet" type="text/css" href="css/index.css">
         <title>Hello World</title>
     </head>
     <body>
@@ -35,8 +36,5 @@
         </div>
         <script type="text/javascript" src="cordova.js"></script>
         <script type="text/javascript" src="js/index.js"></script>
-        <script type="text/javascript">
-            app.initialize();
-        </script>
     </body>
 </html>
diff --git a/bin/templates/project/assets/www/js/index.js b/bin/templates/project/assets/www/js/index.js
index 87b56604..c31cd831 100644
--- a/bin/templates/project/assets/www/js/index.js
+++ b/bin/templates/project/assets/www/js/index.js
@@ -47,3 +47,5 @@ var app = {
         console.log('Received Event: ' + id);
     }
 };
+
+app.initialize();
\ No newline at end of file
diff --git a/framework/res/xml/config.xml b/framework/res/xml/config.xml
index ee68c3b7..ae067831 100644
--- a/framework/res/xml/config.xml
+++ b/framework/res/xml/config.xml
@@ -30,28 +30,26 @@
         Apache Cordova Team
     </author>
 
-    <!-- Allow access to arbitrary URLs in the Cordova WebView. This is a
-         development mode setting, and should be changed for production. -->
-    <access origin="http://*/*"/>
-    <access origin="https://*/*"/>
+    <!-- <content src="http://mysite.com/myapp.html" /> for external pages -->
+    <content src="index.html" />
 
+    <!-- Whitelist docs: https://github.com/apache/cordova-plugin-whitelist -->
+    <access origin="*" />
     <!-- Grant certain URLs the ability to launch external applications. This
          behaviour is set to match that of Cordova versions before 3.6.0, and
          should be reviewed before launching an application in production. It
          may be changed in the future. -->
-    <access origin="tel:*" launch-external="yes"/>
-    <access origin="geo:*" launch-external="yes"/>
-    <access origin="mailto:*" launch-external="yes"/>
-    <access origin="sms:*" launch-external="yes"/>
-    <access origin="market:*" launch-external="yes"/>
-
-    <!-- <content src="http://mysite.com/myapp.html" /> for external pages -->
-    <content src="index.html" />
+    <allow-intent href="http://*/*" />
+    <allow-intent href="https://*/*" />
+    <allow-intent href="tel:*" />
+    <allow-intent href="sms:*" />
+    <allow-intent href="mailto:*" />
+    <allow-intent href="geo:*" />
+    <allow-intent href="market:*" />
 
     <preference name="loglevel" value="DEBUG" />
-        
     <!--
-      <preference name="splashscreen" value="resourceName" />
+      <preference name="splashscreen" value="splash" />
       <preference name="backgroundColor" value="0xFFF" />
       <preference name="loadUrlTimeoutValue" value="20000" />
       <preference name="InAppBrowserStorageEnabled" value="true" />
