header("Content-Security-Policy: default-src 'self' 'unsafe-eval' 'unsafe-inline'  https://*.gstatic.com https://*.googleapis.com; img-src 'self' https://*.gstatic.com https://*.googleapis.com data:;");

 

Vlastimil Pošmura, 2018