title: CSP (Content-Security-Policy) Violation stats.g.doubleclick.net in spite of hostname added to list
body: <p>I am trying to add CSP to our web site, using report-only (to report-uri.com).
  It seems to work as expected for most cases, but google related sites gets reported even if the URL is added to the header.</p>
  <p>Here´s the relevant part of header as it appears in developer tools:
  connect-src 'self' <a href="https://stats.g.doubleclick.net" rel="nofollow noreferrer">https://stats.g.doubleclick.net</a></p>
  <p>I am still getting this violation:
  &quot;blocked-uri&quot;: &quot;https://stats.g.doubleclick.net/j/collect&quot;</p>
  <p>I have experienced similar issues with other Google related sites as well.</p>
  <p>The problem is that we're using Google tags and analysis, so I cannot block the sites out.</p>
  <p>This particular problem seems to come from Chrome only.</p>