Content security policies can also set in a meta tag in html

Ah, you're right. They are setting it in HTML. Updated!