CSP Test Page — WITHOUT nonce (should show CSP violations in console)