This page must carry the STRICT CSP (script-src 'self').
/checkout/ (Paddle.js, loose CSP) · /merge/ (covered by both a /* block and a /merge/* block)