How to defeat Content-Security-Policy?

Question

JavaScript

written for the page

Content-Security-Policy:default-src * 'self' 'unsafe-inline' data: http://*.tile.openstreetmap.org http://*.tile.openweathermap.org http://openweathermap.org http://api.openweathermap.org https://*.gstatic.com;

but all the same the request, though the others work. maybe because it's a JSONP request.
leaflet-openweathermap.js:846 Mixed Content: The page at ' https://example.com/map ' was loaded over HTTPS, but requested an insecure script ' http://api.openweathermap.org/data/2.5/box /city?AP... '. This request has been blocked; the content must be served over HTTPS.
api openweathermap https does not work. I would not want to engage in proxying through my script. Is there a way to defeat this crap?
(there are no cabinets and user input on the site, purely informational, so security is the least of my worries here)