Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://api.mapbox.com https://www.gstatic.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://api.mapbox.com; connect-src 'self' https://api.digitransit.fi wss://mqtt.hsl.fi https://api.mapbox.com https://events.mapbox.com https://rata.digitraffic.fi https://sales-api.hsl.fi https://www.gstatic.com https://fonts.gstatic.com https://europe-west1-julkisilla-production.cloudfunctions.net; img-src 'self' https: data: blob:; worker-src 'self' blob:; font-src 'self' data: https://fonts.gstatic.com; frame-ancestors 'none'; upgrade-insecure-requests