Make manifest's content_security_policy accept both self and remote scripts so that I can load Stripe πŸŽ‰