I wonder if they had CSP and intentionally bypassed or they didn't have CSP at all.