UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36

Example URL:
https://scripts.cmbuckley.co.uk/csp/json.php

Steps to reproduce the problem:
Load URL above, or serve the following PHP script:

<?php
header("Content-Security-Policy: default-src 'self'");
header('Content-Type: application/json');
?>{}

What is the expected behavior?
The styling for the JSON output are applied without displaying the error.

What went wrong?
The message in the console:

> Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'".

Does it occur on multiple sites: Yes

Is it a problem with a plugin? No 

Did this work before? N/A 

Does this work in other browsers? No
 Safari (11.1.2)

Chrome version: 69.0.3497.100  Channel: stable
OS Version: OS X 10.11.6
Flash Version: