content-security-policy/script-src/support/post-message.js

postMessage("importScripts allowed");