Content-Security-Policy-Report-Only: default-src 'self' https: data: blob:; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' blob:; script-src-elem 'self' https: 'unsafe-inline' blob:; style-src 'self' https: 'unsafe-inline' data: blob:; style-src-elem 'self' https: 'unsafe-inline' data: blob:; img-src 'self' https: data: blob:; font-src 'self' https: data: blob: chrome-extension: moz-extension: ms-browser-extension: safari-extension:; connect-src 'self' https: wss:; frame-ancestors 'self'; form-action 'self' https://*.tfaforms.com https://*.tfaforms.net https://*.formassembly.com https://*.govfa.net; worker-src 'self' blob:; report-uri /api_v2/csp/report