Content-Security-Policy-Report-Only: default-src https: 'unsafe-eval' 'unsafe-inline';script-src 'unsafe-eval' 'unsafe-inline' 'self' *.grouponcdn.com bat.bing.com mpsnare.iesnare.com *.boldchat.com www.googleadservices.com static.criteo.net connect.facebook.net b-code.liadm.com www.googletagmanager.com sslwidget.criteo.com *.groupon.com *.googleapis.com *.groupondev.com sc-static.net;connect-src 'unsafe-eval' 'unsafe-inline' 'self' *.grouponcdn.com bat.bing.com mpsnare.iesnare.com *.boldchat.com www.googleadservices.com static.criteo.net connect.facebook.net b-code.liadm.com www.googletagmanager.com *.groupondata.com;style-src 'self' 'unsafe-inline' *.grouponcdn.com bat.bing.com fonts.googleapis.com *.groupondev.com;img-src 'self' data: *.grouponcdn.com *.groupon.com www.google.com *.doubleclick.net rp.liadm.com www.facebook.com bat.bing.com maps.googleapis.com *.groupondev.com maps.gstatic.com *.criteo.net;font-src 'self' *.grouponcdn.com fonts.gstatic.com *.groupondev.com;object-src data: 'unsafe-eval';report-uri /csp-report