Content-Security-Policy: default-src https: blob:; script-src 'unsafe-inline' 'unsafe-eval' https: data:; style-src 'unsafe-inline' https:; img-src data: https: blob: android-webview android-webview-video-poster:; font-src data: https:; connect-src https: wss://socket-gcp.kommunicate.io; media-src https: data: blob:; worker-src https: blob:; upgrade-insecure-requests;