Remove the inline token script blocked by script-src 'self', so the live page no longer calls the snapshot API with token=undefined. Co-authored-by: Cursor <cursoragent@cursor.com>