Firefox doesn't like default-src