Content-Security-Policy: worker-src *