Removed defaults for 'img-src', 'script-src', 'style-src' and
'connect-src'. Only remaining default is 'default-src' = 'none'