fix typo in CSP policy: missing single quote for 'unsafe-eval' directive