setInterval, setTimeout with non-callable args should not execute with policy "script-src 'self' 'unsafe-inline'".