title: How to allow Remote Script from every web site with Content Security Policy -CSP?
body: <p>I read about Content Security Policy from:
  <a href="http://developer.chrome.com/extensions/contentSecurityPolicy.html" rel="nofollow">http://developer.chrome.com/extensions/contentSecurityPolicy.html</a></p>
  
  <p>It is mentioned there that:
  "If you have a need for some external JavaScript or object resources, you can relax the policy to a limited extent by whitelisting secure origins from which scripts should be accepted"</p>
  
  <p>The example shows that you need to add to your manifest.json this line:</p>
  
  <pre><code>"content_security_policy": "script-src 'self' https://example.com; object-src 'self'"
  </code></pre>
  
  <p>but if I want not only to support <a href="https://example.com" rel="nofollow">https://example.com</a>, but every web site?
  btw - is it also possible to include "Evaluated JavaScript": <code>'unsafe-eval'</code> to that?
  what should I write instead?</p>