given that what I think you're doing is injecting a script, one thing that needs to change too is that the script has to go into the head, not the body. Secondly, if we want to load a script, jquery has the loadScript function, so we can use that and see if it violates CSP. If not, we can go the manual route.