<html> <head> <meta charset="utf-8"> </head> <body> <!-- this should be allowed --> <script src="http://mochi.test:8888/tests/dom/security/test/csp/%24.js"> </script> </body> </html>