Content-Security-Policy: default-src 'self' pinned-anytimenetwork:; frame-ancestors 'self'; object-src 'none'; base-uri 'self';