..it’s completely useless:

    Content-Security-Policy: default-src ‘self’ ’*’ 'unsafe-inline’ 'unsafe-eval’