fix #626 - content-security-policy issue with inline javascript used by the facebook provider