add_header Content-Security-Policy "default-src 'self'; report-uri /csp-report" always;