Bug 887974 - CSP: when script-src has both 'unsafe-inline' and 'unsafe-eval' directives present, eval() is still not allowed (r=sstamm a=bbajaj)