[bug959271] - unsafe added to script-src