Content-Security-Policy: default-src https: http: data: 'unsafe-inline' 'unsafe-eval';   connect-src *;   media-src 'self' https: http: blob:;   style-src 'self' 'unsafe-inline' https: http:;   script-src 'self' 'unsafe-inline' 'unsafe-eval' https: http: blob:;   font-src 'self' data: https: http:;