Unlike the high level, this does a JSONP call but does not use a callback, instead it hardcodes the function to call.

The CSP settings only allow external JavaScript on the local server and no inline code.

1+2+3+4+5=