Just use default-src for CSP.