OK. I just ticked that now:
content security policy report only
Still not working. Do I need to remove CSP?