Content-Security-Policy-Report-Only: script-src 'nonce-7BZWMvBRXAi9L0CgYgWfxA==' 'strict-dynamic'; object-src 'none'; base-uri 'none';