Two bug fixes: lambda support for more config values and propegating the default-src value to img-src in one case

Gives the ability to use all config values as lambdas except for experimental and http additions. 

Also fixes a bug where the default-src value was not passed in when :data is auto-added to img-src (see the spec tests)

- "default-src 'self'; img-src data:; script-src 'self';"
+ "default-src 'self'; img-src 'self' data:; script-src 'self';"