include font-src by default

I think this is a safe default.