data: as script src should not run with policy "default-src 'self'".