Cannot override the CSP defaults despite what the doc says

When I add

"img-src 'self' data: 'https://firebasestorage.googleapis.com'",

"img-src 'self' data: 'https://firebasestorage.googleapis.com'",

to my

csp[]

csp[]

list, I get:

Ignoring duplicate Content-Security-Policy directive 'img-src'

How do i override the default

img-src 'self' data:

img-src 'self' data:

Set Content-Security-Policy (CSP) HTTP headers with the csp middleware