Content-Security-Policy-Report-Only: default-src 'self' http://thruinc.com http://*.thruinc.com https://thruinc.com https://*.thruinc.com; script-src http://thruinc.com http://*.thruinc.com https://thruinc.com https://*.thruinc.com; connect-src http://thruinc.com:* http://*.thruinc.com:* https://thruinc.com:* https://*.thruinc.com:*; style-src 'unsafe-inline' http://thruinc.com http://*.thruinc.com https://thruinc.com https://*.thruinc.com; frame-ancestors 'none';