Objects loaded using src attribute of <embed> tag are blocked unless their host is listed as an allowed source in the object-src directive