Content-Security-Policy: frame-ancestors 'self'; block-all-mixed-content; default-src 'self' https://*.shortest-route.com https://mapp.com; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' https://web-sdk.aptrinsic.com https://*.googleapis.com https://*.gstatic.com *.google.com https://*.ggpht.com *.googleusercontent.com blob:; object-src 'none'; frame-src 'self'; child-src 'self'; font-src 'self' https://fonts.gstatic.com; connect-src 'self' esp.aptrinsic.com https://*.googleapis.com *.google.com https://*.gstatic.com  data: blob:; manifest-src 'self'; base-uri 'self'; form-action 'self'; media-src 'self'; worker-src 'self'; style-src 'self' https://*.shortest-route.com https://mapp.com *.googleapis.com https://web-sdk.aptrinsic.com 'unsafe-inline' data:; img-src 'self' https: data:; upgrade-insecure-requests;