Content-Security-Policy: default-src 'self'; script-src 'self' https://static.cloudflareinsights.com https://apis.google.com https://www.google.com https://www.gstatic.com; worker-src 'self' blob:; frame-src 'self' https://roadtripplanner-5039a.firebaseapp.com https://www.google.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://tiles.openfreemap.org https://*.agoda.net https://*.bstatic.com https://*.googleusercontent.com; connect-src 'self' https://*.googleapis.com wss://*.firebaseio.com https://roadtripplanner-5039a.firebaseapp.com https://nominatim.openstreetmap.org https://router.project-osrm.org https://rtp-valhalla.rtplanner.workers.dev https://rtp-hotels.rtplanner.workers.dev https://tiles.openfreemap.org https://api.open-meteo.com https://lz4.overpass-api.de https://z.overpass-api.de https://overpass.kumi.systems https://photon.komoot.io https://get.geojs.io https://cloudflareinsights.com https://www.google.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'