CSP ignored when using remote content

[Pär]

When using a remote content src like <content src="
http://remoteserver.com/app/index.html";> the CSP rules seems to be ignored;
cross origin requests fail even with a "default-src *" CSP. Is this
intended behaviour or a bug?