Strict CSP with style attributes

The block on a page served with style-src 'self' and style-src-attr 'unsafe-inline': the server-rendered style attributes apply, so the calendar renders on the server as usual.