<html>
<head> <meta charset="utf-8"> </head>
  <body>
    <!-- this should be allowed -->
    <script src="http://mochi.test:8888/tests/dom/security/test/csp/%24.js"> </script>
  </body>
</html>