Inline script should not run without 'unsafe-inline' script-src directive.