/*
    Content-Security-Policy: default-src 'self'; img-src 'self' data:; frame-ancestors 'none'
    X-Content-Type-Options: nosniff