default-src has wrong description