CSP: Beacon is covered by 'connect-src', not 'form-action'.