It looks like that with report-uri browser shows more violations in the console..
citation: "The Content Security Policy 'default-src 'self' http://mozorg.cdn.mozilla.net https://themes.googleusercontent.com; frame-src 'self' https://login.persona.org; img-src *; script-src 'self' https://mts0.googleapis.com https://maps.gstatic.com,...; style-src 'self' 'unsafe-inline' ....;' 

was delivered in report-only mode, but does not specify a 'report-uri'; the policy will have no effect. Please either add a 'report-uri' directive, or deliver the policy via the 'Content-Security-Policy' header."

Does it matter?!