Content-Security-Policy: default-src * data: blob: http: https: 'self' https://*.durable.co https://*.durable.com 'unsafe-inline' *.durable.co *.durable.com 'unsafe-eval';