Content Security Policy: The settings of the page have blocked the loading of a resource ("script-src")

Why are you exposing this? Your localhost uses port 90.