Content-Security-Policy: default-src 'unsafe-inline' 'unsafe-eval' localhost dev.here.com:3000 localhost:3000 *.here.com *.hereolp.cn *.hereapi.cn *.omtrdc.net *.arcgis.com *.facebook.net *.facebook.com *.google.com *.googleapis.com fonts.googleapis.com fonts.gstatic.com *.googleusercontent.com csi.gstatic.com dpm.demdex.net data: app:; frame-ancestors 'self' app: http: https:;