Header set Content-Security-Policy "script-src 'none'"