Content-Security-Policy: default-src 'self' *.meddbase.com *.sagepay.com *.elavon.com *.gstatic.com *.google.com *.googleapis.com  *.redoc.ly 'unsafe-eval' 'unsafe-inline' ms-word: ms-excel: ms-powerpoint: ms-visio:; img-src 'self' * data: blob:; font-src 'self' * data:; object-src 'self' *.meddbase.com *.sagepay.com *.elavon.com 'unsafe-eval' 'unsafe-inline' ms-word: ms-excel: ms-powerpoint: ms-visio: data:; frame-src 'self' *.meddbase.com *.sagepay.com *.elavon.com *.americanexpress.com *.touchtechpayments.com 'unsafe-eval' 'unsafe-inline' ms-word: ms-excel: ms-powerpoint: ms-visio: blob: *.visbion.com;connect-src 'self' *.meddbase.com *.googleapis.com *.sagepay.com *.elavon.com wss://*.meddbase.com ws://*.meddbase.com blob:; report-uri /webservices/cspreport; worker-src 'self' blob: