allow unsafe-inline js as well to allow plugins to work properly