default-src set to '*' if user doesn't set default-src directive