I'm with @sedge here I think.

Another potential consideration here is how the config variable is picked up - it feels like an inline only solution, which means that if we want to enforce CSP we would need to refactor things.