What breaks if the merchant's CSP restricts inline scripts or frame-src · InterviewLane