Policies set via meta tags can only be made subsequently more restrictive: https://w3c.github.io/webappsec-csp/#multiple-policies.