cURL doesn't load subresources or honour Content-Security-Policy headers as this is beyond the scope of what it's supposed to do.