BUG: CONSTANT: Fixed #7. inline-eval should be eval-script. Fixed #8. xhr-src is deprecated directive.

xhr-src is a deprecated directive for 1.0's connect-src.

Please refer to ian's https://blog.mozilla.org/security/2013/06/11/content-security-policy-1-0-lands-in-firefox/