Content-Security-Policy: default-src 'self' https: https://ajax.googleapis.com https://cdn.jsdelivr.net https://dnnapi.com https://cdnjs.cloudflare.com https://cdn.cookielaw.org; font-src * data:; connect-src 'self' https: https://wtwdevcbot-bot.azurewebsites.net wss://directline.botframework.com; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' blob:; style-src * 'unsafe-inline' 'unsafe-eval' blob:; media-src 'self' https: 'unsafe-inline' 'unsafe-eval'; img-src 'self' https: 'unsafe-inline' 'unsafe-eval' data: blob: