<meta http-equiv="content-security-policy" content="default-src 'self'">