HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Security-Policy: treat-as-public-address