Got schooled by @NahamSec when we showed him this common CSP bypass.