CSP strict-dynamic bypass by @kkotowicz

via Polymer itself.

Improvement over poc2.html. No component is needed, as Polymer itself will just document.createElement('script'). No idea how applicable that one is in real Polymer apps, might be bogus.