fix unsafe-inline and unsafe-eval

• unsafe-inline and unsafe-eval were missing quotes and thus were being seen as a domain. Add the missing quotes to the headers