script-src 'none' is a more secure solution.