Why it's bad to use 'unsafe-inline' in script-src | Hacker News Reader