script-src 'self'; report-to csp-reporting-endpoint