Don't recommend CSP 'unsafe-eval'

as of the 3.0.2 release, the status message:
- Still includes 'unsafe-eval' 😞
- * allows any HTTP(S) scheme or domain, so also including https: is redundant.

Recommending default-src * data: 'unsafe-inline' 'unsafe-eval'; is little (if any) better than not specifying a Content Security Policy.

----

The default policy I have suggested for core to adopt in 📌 Add a default CSP and clickjacking defence and minimal API for CSP to core Active is script-src * 'unsafe-inline'; object-src 'none'; frame-ancestors 'self', which blocks 'unsafe-eval' and other domains from being able to load pages in an iframe.

Rather than including a specific policy in the status message, I would recommend including a link to documentation or a guide on getting started with CSP, since individual site's needs will vary.

Makes sense. I removed recommendation from the status page.

Automatically closed - issue fixed for 2 weeks with no activity.