Content Security Policy hates inline JS

[GBH]

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src

So the example provided won't work. The only work-around I could figure out was moving url and settings into meta tags as you can't even hash that script tag due to dynamic values.

If somebody has a better idea, I'm all ears.