title: How do you whitelist a specific domain for a specific content security policy directive, while having a less specific directive for other domains?
body: <p>I want to allow <code>unsafe-eval</code> for a <code>script-src</code> policy, but only for a specific domain.</p>
  <p>For example, I only want scripts from <code>*.example.net</code> to be able to use <code>eval()</code>.</p>
  <pre><code>script-src 'unsafe-inline' *;script-src 'unsafe-eval' 'unsafe-inline' *.example.net blob:;
  </code></pre>
  <p>The above does not work. How can I achieve this behavior?</p>