If disabled, use the websites default CSP, but an empty