X-Frame-Options:DENY X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Content-Security-Policy:default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'none'; Access-Control-Allow-Origin: http://olsns.org Referrer-Policy: same-origin