Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-src https: data: 'self' blob:;