Inline script attached by DOM manipulation should not run with policy "default-src *".