script from www2.w3c-test.org should not run with policy "script-src 'self' www.w3c-test.org".