Content-Security-Policy: default-src https: http: blob: javascript: data: 'unsafe-inline' 'unsafe-eval' 'self';