page: restrict security policy of base-src