Any form of CSP will break the admin plugin

When deploying CSP in the HTTP headers through the .htaccess file it will break the admin plugin, even with 'unsafe-eval' enabled. Unsure what the exact root cause is. From the firebug console it seems the CSP policy is blocking the loading of a resource based on the script-src policy, which unless the admin plugin requires external scripts should be fine (doesn't seem that the admin plugin actually calls an external script as far as I can judge).

`# CSP Apache
Header set Content-Security-Policy "default-src 'self' http://www.google-analytics.com https://stats.g.doubleclick.net https://maxcdn.bootstrapcdn.com/; script-src 'self' 'unsafe-eval' https://ajax.googleapis.com www.google-analytics.com; style-src 'self' https://maxcdn.bootstrapcdn.com; media-src 'self';"`

Reproduce the admin plugin failure using the CSP header in the .htaccess configuration and inspect the blocked resource reported by Firebug. Trace which admin-plugin resource is rejected by the script-src policy and identify the required policy or plugin change. Done means the admin plugin works under the reported CSP configuration and the root cause is covered by a regression check.

Written by the indexing model from the issue text.