Content-Security-Policy: worker-src 'self'