Tests that default-src does not cascade to form-action.