Inline script should not run with policy "default-src *".