Content-Security-Policy: default-src 'self' *.apple.com *.cdn-apple.com *.apple-mapkit.com *.autonavi.com blob:; img-src *.apple.com *.cdn-apple.com *.apple-mapkit.com *.autonavi.com *.apple.com.cn  data: 'unsafe-inline'; script-src 'unsafe-inline'   'unsafe-eval' *.apple.com *.cdn-apple.com *.apple-mapkit.com *.autonavi.com blob:; frame-src *.cardinalcommerce.com *.apple.com *.cdn-apple.com *.apple-mapkit.com; style-src 'unsafe-inline' *.apple.com *.cdn-apple.com *.apple-mapkit.com *.autonavi.com