Content-Security-Policy: default-src 'self';upgrade-insecure-requests;object-src 'none';frame-ancestors 'none';sandbox allow-forms allow-same-origin allow-scripts allow-popups;base-uri 'self';connect-src 'self' *;img-src 'self' *;font-src 'self' fonts.gstatic.com maxcdn.bootstrapcdn.com;style-src 'self' fonts.googleapis.com maxcdn.bootstrapcdn.com 'unsafe-inline';script-src 'self' dc.services.visualstudio.com www.google-analytics.com az416426.vo.msecnd.net maxcdn.bootstrapcdn.com code.jquery.com cdnjs.cloudflare.com 'unsafe-inline';