Content-Security-Policy: default-src 'self' https://api.zotero.org; script-src 'self' https://api.zotero.org 'nonce-e4a654qkvo'; style-src 'self' 'nonce-jf7wz59g7o'; img-src 'self' https://s3.amazonaws.com/; frame-src 'self'; connect-src 'self' https://api.zotero.org https://api.zotero.org https://www.zotero.org https://zoterofilestorage.s3.amazonaws.com https://zoterofilestorage.s3.us-east-1.amazonaws.com/ https://t0guvf0w17.execute-api.us-east-1.amazonaws.com https://services.zotero.org wss://stream.zotero.org https://files.zotero.net; child-src 'self'; worker-src 'self'