Seems like you have a default CSP applied, one very strict with just "default-src 'none'". You need to locate this one and turn it off. All content needs to pass all policies, and this one blocks everything.