allow unsafe-inline for style-src