Access-Control-Allow-Credentials: true Server: nginx Vary: Accept-Encoding X-Forwarded-Proto: http Access-Control-Allow-Headers: Authorization,Content-Type,Accept,Origin,Pragma,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since Connection: keep-alive Date: Tue, 07 Nov 2017 09:46:56 GMT Content-Type: text/html HTTP/1.1 200 OK Access-Control-Allow-Origin: * X-Content-Security-Policy: default-src * data: 'unsafe-inline' 'unsafe-eval'; media-src * blob:; X-WebKit-CSP: default-src * data: 'unsafe-inline' 'unsafe-eval'; media-src * blob:; Transfer-Encoding: chunked X-XSS-Protection: 1 Access-Control-Allow-Methods: POST,GET,PUT,DELETE,OPTIONS X-Page-Speed: 1.12.34.2-0 Content-Security-Policy: default-src * data: 'unsafe-inline' 'unsafe-eval'; media-src * blob:; Cache-Control: max-age=0, no-cache