Inline script should not run without 'unsafe-inline' script-src directive, even for script-src *.