title: Content-Security-Policy errors in Firefox and Chrome
body: <p>In my code, I have set below :</p>
  
  <pre><code>response.setHeader("Content-Security-Policy", "default-src 'self'");
  </code></pre>
  
  <p>This works fine in Internet Explore.</p>
  
  <p>In Chrome, I get the following error:</p>
  
  <blockquote>
    <p>Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-3o30MP9eULqjOPAYfNq0dz2I/NLmIV2JYJR7D96q+wM='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.**</p>
  </blockquote>
  
  <p>In Firefox, I get the following error:</p>
  
  <blockquote>
    <p>Content Security Policy: The page’s settings blocked the loading of a resource at inline (“default-src”)</p>
  </blockquote>
  
  <p>I have tried adding unsafe-inline keyword, which works in Chrome but does not work in Firefox.</p>