content-security-policy: default-src 'self';