isnt inline JS disabled by CSP? @LukasReschke