Content-Security-Policy: sandbox allow-same-origin allow-top-navigation;