default
This should be same as "strict-origin-when-cross-origin".