unsafe-inline in your CSP basically turns off XSS protection. Here's how to get rid of it using nonces, hashes, or by refactoring your code.