Content-Security-Policy: form-action 'self';