Content-Security-Policy: object-src 'none'; base-uri 'none'; require-trusted-types-for 'script'; trusted-types default dompurify html2canvas;