CSP: Allow <meta> to tighten existing policy.