Vary: Accept-Encoding Transfer-Encoding: chunked X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 20 Feb 2018 18:46:48 GMT X-Content-Type-Options: nosniff Content-Type: text/html; charset=utf-8 HTTP/1.1 200 OK Server: webserver X-Permitted-Cross-Domain-Policies: master-only Cache-Control: max-age=0, no-cache, no-store Connection: keep-alive X-Page-Speed: 1.13.35.2-0 Content-Security-Policy: default-src 'self' *.gazkazan-kazan.hu *.hotjar.com *.wirecard.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.gazkazan-kazan.hu *.wirecard.com *.google.hu *.google-analytics.com *.facebook.net *.youtube.com *.google.com *.googlevideo.com *.gstatic.com *.facebook.com *.googleapis.com *.googleadservices.com *.doubleclick.net *.hotjar.com *.arukereso.hu; img-src 'self' *.gazkazan-kazan.hu *.google-analytics.com *.google.hu blob: data: *.gazkazan-kazan.hu *.google-analytics.com *.facebook.net *.youtube.com *.google.com *.googlevideo.com *.gstatic.com *.facebook.com *.googleapis.com *.googleadservices.com *.doubleclick.net *.hotjar.com *.arukereso.hu; style-src 'self' 'unsafe-inline' *.gazkazan-kazan.hu *.facebook.net *.youtube.com *.google.com *.googlevideo.com *.gstatic.com *.facebook.com *.googleapis.com *.googleadservices.com *.doubleclick.net *.hotjar.com *.arukereso.hu; font-src 'self' data: *.gazkazan-kazan.hu *.facebook.net *.youtube.com *.google.com *.googlevideo.com *.gstatic.com *.facebook.com *.googleapis.com *.googleadservices.com *.doubleclick.net *.hotjar.com *.arukereso.hu; child-src 'self' *.gazkazan-kazan.hu *.wirecard.com *.facebook.net *.youtube.com *.google.com *.googlevideo.com *.gstatic.com *.facebook.com *.googleapis.com *.googleadservices.com *.doubleclick.net *.hotjar.com *.arukereso.hu; object-src 'self' Set-Cookie: symfony=4gf7re803be0npsrm6f8676qo1; path=/; secure; HttpOnly X-Frame-Options: SAMEORIGIN Pragma: no-cache