title: Content security policy including a script
body: <p>I need to include this script <a href="https://apis.google.com/js/api:client.js" rel="noreferrer">https://apis.google.com/js/api:client.js</a> in my website. On Google Chrome it works fine, but on <strong>Firefox</strong> (and IE obviously), I get some errors:</p>
  
  <blockquote>
    <p>Content Security Policy: Ignoring “‘unsafe-inline’” within script-src: ‘strict-dynamic’ specified<br>
    Content Security Policy: Ignoring “https:” within script-src: ‘strict-dynamic’ specified<br>
    Content Security Policy: Ignoring “http:” within script-src: ‘strict-dynamic’ specified</p>
  </blockquote>
  
  <p>I tried to change the <strong>content security policy</strong> header in a meta tag but it didn't work.</p>
  
  <p>I tried with all of these:</p>
  
  <pre class="lang-html prettyprint-override"><code>&lt;meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self'; script-src 'self' apis.google.com; style-src 'self';"&gt;
  &lt;meta http-equiv="Content-Security-Policy" content="default-src 'self' apis.google.com"&gt;
  &lt;meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-eval' https://*.google.com; object-src 'self' 'unsafe-eval'"&gt; 
  &lt;meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-eval' apis.google.com;"&gt;
  </code></pre>