I was testing the full link to see if the CSP was that specific, I have dropped it and added slashes:
However I am still seeing the same behavior with CSP. I am testing hosted.