I think for img-src we'll need to set it to `"*"` since all of the images on https://webmaker.org can come from different domains