Bug 885433 - CSP should not block inline scripts or eval unless script-src or default-src are included (r=imelven a=bajaj)