We're not enforcing here, just parsing and validating the policy string as per the CSP spec.

(I modelled this as per the other members. For example, the steps for processing the start_url member algo returns a valid URL.)