title: Content-Security-Policy does not work although I use a wildcard
body: <p>In my Meteor/Cordova project, the user can upload an image. This image is then uploaded to a cloud service. But before, I already want to display the uploaded image to the user. Immediately! So I take the cdvfile-Url and set it as the <code>&lt;img&gt;</code>s "src". For example:</p>
  
  
  
  <pre class="lang-html prettyprint-override"><code>&lt;img src="cdvfile://localhost/root/storage/emulated/0/x/y.jpg" /&gt;
  </code></pre>
  
  <p>My CSP meta Tag looks like this:</p>
  
  <pre class="lang-html prettyprint-override"><code>&lt;meta http-equiv="Content-Security-Policy" content="default-src *; img-src *"&gt;
  </code></pre>
  
  <p>Unfortunately, this is what I get as a result, although the meta tag is not very restrictive:</p>
  
  <blockquote>
    <p>Refused to load the image
    'cdvfile://localhost/root/storage/emulated/0/x/y.jpg' because it
    violates the following Content Security Policy directive: "img-src *".</p>
  </blockquote>
  
  <p>I have tried a huge number of variations of the CSP Meta Tag with no luck.  I have tried with and without <code>cordova-plugin-whitelist</code>. Anybody who has a clue and can help?</p>
  
  <p>Thanks</p>