/*
    Content-Security-Policy: default-src 'self'; img-src 'self' 'data:'; frame-ancestors 'none'
    X-Content-Type-Options: nosniff