Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://apis.google.com https://cdn.emailjs.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https://i.pravatar.cc https://images.pexels.com https://picsum.photos https://fastly.picsum.photos https://ui-avatars.com https://lh3.googleusercontent.com https://www.gstatic.com https://*.basemaps.cartocdn.com https://images.unsplash.com https://firebasestorage.googleapis.com; connect-src 'self' https://*.firebaseio.com https://*.googleapis.com wss://*.firebaseio.com https://firestore.googleapis.com https://identitytoolkit.googleapis.com https://securetoken.googleapis.com https://*.basemaps.cartocdn.com https://data.calgary.ca https://api.open-meteo.com https://geo.weather.gc.ca https://511.alberta.ca https://www.alberta.ca https://api.emailjs.com https://smtp.emailjs.com; frame-src https://accounts.google.com https://calgary-map-e70bb.firebaseapp.com; object-src 'none'; base-uri 'self'; form-action 'self' mailto:; worker-src blob:;