Content-Security-Policy: "default-src 'none'" X-Content-Security-Policy: "default-src 'none'" X-WebKit-CSP: "default-src 'none'"