/*
    Content-Security-Policy: default-src 'self'; frame-ancestors 'none'
    X-Content-Type-Options: nosniff