Strict-Transport-Security: max-age=63072000; includeSubdomains; preload X-Frame-Options: SAMEORIGIN, SAMEORIGIN Cache-Control: private, no-cache, no-store Content-Security-Policy: default-src 'self' m.addthis.com; style-src 'self' 'unsafe-inline' *.twitter.com *.google.com https://*.google.com *.googleapis.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.syndication.twimg.com https://*.twitter.com https://*.ytimg.com https://apis.google.com https://*.youtube.com *.twitter.com *.facebook.net https://www.googleapis.com *.google.com *.google-analytics.com *.addthis.com https://*.google-analytics.com https://*.addthis.com;img-src http://clients1.google.com/generate_204 https://*.gstatic.com https://www.googleapis.com http://www.google.com https://www.google.com https://clients1.google.com http://clients1.google.com https://www.facebook.com *.pmo.mavenm.com *.pmo.gov.sg *.google-analytics.com *.facebook.com;frame-src 'self' https://accounts.google.com https://cse.google.com http://*.facebook.com http://*.addthis.com http://*.youtube.com https://*.facebook.com https://*.addthis.com https://*.youtube.com;font-src 'self' *.gstatic.com;frame-ancestors 'none'; form-action 'self'; reflected-xss block;block-all-mixed-content; Date: Fri, 02 Jun 2017 21:39:06 GMT Pragma: no-cache Content-Language: en HTTP/1.1 200 OK X-Permitted-Cross-Domain-Policies: none Expires: Fri, 02 Jun 2017 21:39:06 GMT Connection: keep-alive Last-Modified: Fri, 02 Jun 2017 17:53:52 GMT Content-Length: 38106 Access-Control-Allow-Origin: http://www.pmo.gov.sg X-XSS-Protection: 1; mode=block Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff