_headers

/*
  Strict-Transport-Security: max-age=25920000; includeSubDomains; preload
  Content-Security-Policy: upgrade-insecure-requests; default-src 'self'; object-src 'none'; base-uri 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; report-to csp-endpoint; report-uri https://mccraw.report-uri.com/r/d/csp/enforce
  Report-To: { "group": "csp-endpoint", "max-age": 31536000, "endpoints": [{ "url": "https://mccraw.report-uri.com/r/d/csp/enforce" }], "include_subdomains": true},{"group":"default","max_age":31536000,"endpoints":[{"url":"https://mccraw.report-uri.com/a/d/g"}], "include_subdomains":true}
  NEL: {"report_to":"default","max_age": 120,"include_subdomains":true}

/foobar
  Content-Security-Policy-Report-Only: default-src 'self'; report-uri https://mccraw.report-uri.com/r/d/csp/reportOnly