X-XSS-Protection: 1; mode=block; Content-Security-Policy: default-src https://hhs.tv:*;