Content-Security-Policy: default-src 'self' https: http: data: wss: blob: 'unsafe-inline' 'unsafe-eval';script-src 'self' 'unsafe-inline' 'unsafe-eval' https: http:;