/*
    Content-Security-Policy: default-src 'self'
    X-Content-Type-Options: nosniff