won't CSP block inline JS?