recent CSP headers added by Github prevented inline-scripts