Refused to load the script 'https://s.hatena.ne.jp/js/HatenaStar.js' because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self' https://h.kokuda.org". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
@akkiesoft config/initializers/content_security_policy.rbに足せば良さそう