michael@0: X-Content-Security-Policy: default-src 'none' ; img-src http://example.org
michael@0: Content-Security-Policy: default-src 'self'