<%

   String cspNonce = Integer.toHexString(net.i2p.util.RandomSource.getInstance().nextInt());

   response.setHeader("X-Frame-Options", "SAMEORIGIN");
   // TODO after removing innterHTML: script-src 'self' 'unsafe-inline' 'nonce-" + cspNonce + "'
   response.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; form-action 'self'; frame-ancestors 'self'; object-src 'none'; media-src 'none'");
   response.setHeader("X-XSS-Protection", "1; mode=block");
   response.setHeader("X-Content-Type-Options", "nosniff");
   response.setHeader("Accept-Ranges", "none");
   response.setHeader("Referrer-Policy", "no-referrer");
%>
