Content-Security-Policy: default-src 'unsafe-inline' https:; img-src 'self' data: https:; script-src 'unsafe-eval' 'unsafe-inline' https: data: blob:; font-src * data: blob:; frame-src 'self' https://storymaps.arcgis.com/ https://status.nearmap.com/ https://www.youtube.com/ https://www.youtube-nocookie.com/ https:;