CSP nonce and src test

The following script tag is whitelisted by nonce.