Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline';frame-ancestors 'self';