Open the browser console: two CSP violations expected.
default-src 'self'
Loader tag: unknown (inline script blocked?)