Sitecore snuck in Content Security Policy!

https://blog.jermdavis.dev/posts/2020/sitecore-snuck-in-content-security-policy