Add data: and unsafe-local for base64 fonts and inline js

People who know / understand more, *please* sanity check this.

Added:
• data: for base64 including fonts
• 'unsafe-inline' to allow inline js to execute