fix default src blocking for CSPs