Fixed test_malformed_csp to test 'self' typo. Fixed #280.

After #254 is fixed, the regex for source expression has been updated
and improved to accept valid hostnames like localhost. This means
even img-src is considered valid if they are not directive (if they
fall under source list).