Content-Security-Policy: upgrade-insecure-requests; default-src * 'unsafe-inline' 'unsafe-eval' data: blob:;