Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' *.hsbc.com.tr *.optimizely.com *.cdn.optimizely.com ad.doubleclick.net adservice.google.com akamai.tiqcdn.com analytics.twitter.com *.tealiumiq.com googleads.g.doubleclick.net static.ads-twitter.com t.co track.adform.net *.googleadservices.com tags.tiqcdn.com *.googletagmanager.com bid.g.doubleclick.net *.doubleclick.net *.googleapis.com *.youtube.com *.gstatic.com *.google.com.tr *.highcharts.com *.brightcove.net *.google.com *.g.doubleclick.net *.hsbc.com.tr;