Re: Content Security Policy without unsafe-inline

[Lance Java]

If there was no time to live I could kill your server by requesting lots of
pages and never requesting the javascript :)

If url encoding I could get your cookie if you visit my (external) site
which includes a script from your site.