Allow inline scripts if allowing scripts at all, and always allow inline CSS