Content-Security-Policy: default-src 'self' * data: 'unsafe-inline' 'unsafe-eval' 'self' *; frame-ancestors 'self' https://employer.schoolspring.com https://demo.schoolspring.com https://admin.schoolspring.com;