This appears to be affecting Chrome 69. Runs fine in Firefox. Dev console throws: "Refused to load the font '<URL>' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback."