Ember’s contentSecurityPolicy

I have set this in my config

ENV['contentSecurityPolicy'] = {
  'connect-src': "'self' http://10.0.1.3:8000"
};

but seams to be entirely ignored. Am I doing something wrong? The goal would be to send the ajax calls to that ip, or localhost. Tried that one too, same result.