unsafe-inline must be specified for backwards compat

hash source is only supported in canary + experimental flags. Therefore, backwards compat should be required and not optional.