[url-hash-in-header-and-meta.https.html]
  [more lax meta tag should still allow script]
    expected: FAIL

  [multiple meta tags should apply most strict policy - both lax]
    expected: FAIL