is the default-src necessary if you're using sandbox or is it redundant?

`sandbox` doesn’t affect making requests via HTML (images, stylesheets, etc.).