default-src is now none in locked mode.