title: Browser not using metatag Content Security Policy
body: <p>I am trying to load some css and scripts via some CDNs to improve loading times but I am getting a content security policy issue, but after a fair amount of time reading up on it and trying out different polices it is still giving my the same error.</p>
  
  <p>Currently my policy looks like this -</p>
  
  <pre><code> &lt;meta http-equiv="Content-Security-Policy" content="default-src 'self' https://code.jquery.com/ https://cdnjs.cloudflare.com/ https://maxcdn.bootstrapcdn.com/"&gt;
  </code></pre>
  
  <p>which from my understanding should mean I can load anything from the site itself and the 3 URLs E.G for maxcdn I should be able to load <a href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" rel="nofollow noreferrer">https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js</a> </p>
  
  <p>I did try the very simple and not to be used policy of </p>
  
  <pre><code>&lt;meta http-equiv="Content-Security-Policy" content="default-src *"&gt;
  </code></pre>
  
  <p>but that didn't change anything.</p>
  
  <p>The error I'm getting is - </p>
  
  <blockquote>
    <p>Refused to load the script '<a href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" rel="nofollow noreferrer">https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js</a>' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.</p>
  </blockquote>
  
  <p>The script its trying to load (I will do fall backs after i get this working)- </p>
  
  <pre><code>    &lt;script type="text/javascript" src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"
          integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa"
          crossorigin="anonymous"&gt;&lt;/script&gt;
  </code></pre>
  
  <p>I have tested in chrome (55.0.2883.87) and Edge.</p>
  
  <p>From the error message its as if its not taking my policy but using the default policy set by the browser?</p>
  
  <p>Any help would be much appreciated :) </p>