PSA: Try not to chuck 'unsafe-inline' into your Content-Security-Policy thoughtlessly--it disables the anti-injection protections of CSP. There are safe ways to permit inline scripts, if you even need them.

https://content-security-policy.com/