script-src nonce
CSP is active on both pages. The script is only allowed when it carries a nonce attribute that matches the value in the response header — a random token generated fresh on every request.
Response header
Content-Security-Policy: script-src 'self' 'nonce-vbgHP/jYqe0k3mx85QfBPA=='
Inline script in page source
<script nonce="vbgHP/jYqe0k3mx85QfBPA==">markScriptRan();</script>