Content-Security-Policy: default-src 'self' *.firebaseio.com *.firebaseapp.com *.googleapis.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.gstatic.com www.gstatic.com *.googleapis.com *.firebaseapp.com *.googletagmanager.com www.google-analytics.com unpkg.com cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' *.googleapis.com *.gstatic.com www.gstatic.com; img-src 'self' data: blob: *.googleusercontent.com *.ggpht.com *.cartocdn.com *.basemaps.cartocdn.com *.tile.openstreetmap.org server.arcgisonline.com; connect-src 'self' *.firebaseio.com *.googleapis.com *.firebase.com *.google.com *.analytics.google.com *.googletagmanager.com www.google-analytics.com googletagmanager.com nominatim.openstreetmap.org api.open-meteo.com api.frankfurter.app; frame-src 'self' accounts.google.com; child-src 'self' accounts.google.com;