ext-control: secured script-src only