Objects loaded using data attribute of <object> tag are blocked unless their host is listed as an allowed source in the object-src directive