<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>foo</title> <!-- can't be inline, because of CSP --> <script src="foo.js"></script> </head> </html>