Remove unsafe-inline from CSP script sources (report only for now)

SciPost_v1/settings/base.py

@@ -189,7 +189,7 @@ MIDDLEWARE = (
 )
 
 SECURE_BROWSER_XSS_FILTER = True
-SECURE_HSTS_SECONDS = 60
+SECURE_HSTS_SECONDS = 120
 SECURE_HSTS_INCLUDE_SUBDOMAINS = True
 SECURE_HSTS_PRELOAD = True
 SECURE_CONTENT_TYPE_NOSNIFF = True
@@ -203,7 +203,6 @@ CSP_IMG_SRC = ("'self'", 'scipost.org',
                'data:', 'ajax.googleapis.com', 'assets.crossref.org',
                'licensebuttons.net', 'crossmark-cdn.crossref.org')
 CSP_SCRIPT_SRC = ("'self'", 'scipost.org',
-                  "'unsafe-inline'",
                   'ajax.googleapis.com',
                   'cdnjs.cloudflare.com', 'crossmark-cdn.crossref.org',
                   'www.recaptcha.net', 'www.gstatic.com',