UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Steps to reproduce the problem:
1. Issue the following header:
Content-Security-Policy:script-src 'sha256-mKJDJIdVRrRXhbmGO1dKifUUG6KL/F8a5QDbfPQhijY=';

And echo out the following script (which hashes to the value in the header):
<script>window.onload=function(){document.body.style="background:green;";}</script>

Observe that Chrome (correctly) allows this script to run.

2. While still issuing the previous header, issue an additional header:
Content-Security-Policy-Report-Only:default-src 'self';

Again, echo out the previous script.

Observe that Report-Only mode has affected the enforced policy, the background is no longer green. 

Additionally look in console for:
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'sha256-mKJDJIdVRrRXhbmGO1dKifUUG6KL/F8a5QDbfPQhijY='". Either the 'unsafe-inline' keyword, a hash ('sha256-mKJDJIdVRrRXhbmGO1dKifUUG6KL/F8a5QDbfPQhijY='), or a nonce ('nonce-...') is required to enable inline execution.

The console helpfully provides a hash as a suggested value, right after listing the exact same hash as part of the violated policy.

What is the expected behavior?
Both enforced behaviours are identical.

(Though, report only should issue a browser console warning about the lack of a hash in script-src).

What went wrong?
CSPRO is affecting the behaviour of CSP (enforced) – even though it shouldn't.

Did this work before? N/A 

Chrome version: 53.0.2785.143  Channel: n/a
OS Version: OS X 10.11.6
Flash Version: Shockwave Flash 23.0 r0

Let me know if you can't easily reproduce the problem, I'll stick a test page up.