default-src should cascade to img-src directive