http-equiv="Content-Security-Policy" content="default-src resource: chrome:; object-src 'none'; img-src chrome:;" /> PK