I wonder if we can do this:

`<script type="text/x-handlebars" data-template-name="application" src="/path/to/.hbs>`

With `unsafe-eval` switched on, a lot of the benefits of CSP are lost.