Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-c9ba1d47c1b767d7' code.jquery.com; style-src 'self' 'nonce-c9ba1d47c1b767d7' code.jquery.com; style-src-attr 'unsafe-inline'; img-src 'self' data: secure.gravatar.com code.jquery.com; connect-src 'self' typesense.jquery.com; font-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; block-all-mixed-content ; report-to csp-endpoint; report-uri https://csp-report-api.openjs-foundation.workers.dev/;