more blob: uri tests for script-src