title: Content security policy blocking requests to *://www.google.com/recaptcha/api
body: <p><a href="http://code.google.com/p/chromium/issues/detail?id=107538" rel="nofollow">In light of this link</a> ,
  it would seem inline scripts such as are used for inserting a recaptcha object in the page, via </p>
  
  <pre><code>&lt;script type="text/javascript"
       src="http://www.google.com/recaptcha/api/challenge?k=your_public_key"&gt;
  &lt;/script&gt;
  &lt;noscript&gt;
  &lt;iframe src="http://www.google.com/recaptcha/api/noscript?k=your_public_key"
       height="300" width="500" frameborder="0"&gt;&lt;/iframe&gt;&lt;br&gt;
  &lt;textarea name="recaptcha_challenge_field" rows="3" cols="40"&gt;
  &lt;/textarea&gt;
  &lt;input type="hidden" name="recaptcha_response_field"
       value="manual_challenge"&gt;
  &lt;/noscript&gt;
  </code></pre>
  
  <p>or via</p>
  
  <pre><code> &lt;script type="text/javascript" src="http://www.google.com/recaptcha/api/js/recaptcha_ajax.js"&gt;&lt;/script&gt;
  </code></pre>
  
  <p>with</p>
  
  <pre><code>Recaptcha.create("your_public_key",
  "element_id",
  {
    theme: "red",
    callback: Recaptcha.focus_response_field
  }
  </code></pre>
  
  <p>);</p>
  
  <p>I always get some complaint about the content security policy, despite my manifest.json apparently allowing urls' like <a href="http://www.google.com/recaptcha/api/js/recaptcha_ajax.js" rel="nofollow">http://www.google.com/recaptcha/api/js/recaptcha_ajax.js</a></p>
  
  <p>Am I missing something really obvious that makes this whole question crazy?</p>