data: as script src should run with policy "default-src 'self' data:".