X-Xss-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Date: Mon, 26 Feb 2018 13:44:49 GMT Connection: keep-alive Strict-Transport-Security: max-age=15552000; includeSubDomains HTTP/1.1 200 OK Content-Length: 30866 X-Dns-Prefetch-Control: off X-Download-Options: noopen Server: Cowboy Content-Type: text/html; charset=utf-8 Referrer-Policy: same-origin Content-Security-Policy: default-src 'self' localhost:3000 pausa.ngrok.io *.stripe.com *.facebook.com *.facebook.net *.contentful.com *.segment.io *.drift.com *.driftt.com *.mixpanel.com *.fullstory.com *.autopilothq.com *.youtube.com *.vimeo.com *.snapwidget.com snapwidget.com *.plaid.com giphy.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.stripe.com *.ngrok.io *.segment.com *.segment.io *.autopilothq.com *.drift.com *.driftt.com google.com *.google-analytics.com momentjs.com npmcdn.com use.fontawesome.com checkout.stripe.com *.heapanalytics.com *.fullstory.com *.mxpnl.com *.mixpanel.com *.googleadservices.com *.facebook.net *.doubleclick.net *.snapwidget.com snapwidget.com *.plaid.com; style-src 'self' 'unsafe-inline' googleapis.com fonts.googleapis.com use.fontawesome.com *.snapwidget.com snapwidget.com; font-src 'self' fonts.com use.fontawesome.com fonts.googleapis.com fonts.gstatic.com; img-src 'self' data: scontent.xx.fbcdn.net *.stripe.com *.facebook.com *.google-analytics.com *.doubleclick.net *.wikimedia.org *.giphy.com *.heapanalytics.com *.google.com heapanalytics.com *.pennyappeal.org *.contentful.com giphy.com i.ytimg.com; report-uri /logs/report-violation; object-src 'self'; upgrade-insecure-requests Set-Cookie: connect.sid=s%3AAxQC8EmxGjFbFRepdrutQMbFa9M11WBH.3AyYBEWahLzCAgsuNpbqcf6DDJGBJ%2BgjViBrNFUiVFU; Path=/; HttpOnly Vary: Accept-Encoding Set-Cookie: optimizely_userId=37200940-1afb-11e8-9cf3-b95ca19dfb5e; Max-Age=157680000; Path=/; Expires=Sat, 25 Feb 2023 13:44:49 GMT Etag: W/"7892-lGOugLLEzsHDYcS/UnJOksU1PUg" Via: 1.1 vegur X-Content-Type-Options: nosniff