Content security policy problem on ugliest-todo-cordova

[lucky-blip]

It seems that the content policy security tag is missing on the userbase Cordova example
https://github.com/apache/cordova-plugin-whitelist/blob/master/README.md#content-security-policy
So the javascript code cannot be executed on IOS and Android versions below Android 10 because of domain whitelist + inline-script