Pragma: no-cache Access-Control-Allow-Credentials: true X-Frame-Options: SAMEORIGIN Transfer-Encoding: chunked Set-Cookie: PHPSESSID=a06a2be60873f33ab17e3e3902a82f2e; path=/; HttpOnly Content-Security-Policy: report-uri //csp.merlion.ru:8080/report/963066156255080967/; connect-src https://*.yandex.ru http://www.google-analytics.com 'self' ; child-src 'none' ; font-src 'self' ; form-action 'self' ; frame-ancestors webvisor.com *.webvisor.com ; frame-src *.youtube.com http://www.google-analytics.com https://*.yandex.ru 'self' ; img-src data: https://*.yandex.ru http://www.google-analytics.com https://*.yandex.net *.merlion.com *.merlion.ru 'self' api-maps.yandex.ru *.maps.yandex.net ; media-src 'self' ; object-src 'self' ; script-src https://*.yandex.ru https://yastatic.net 'self' *.google-analytics.com *.yandex.ru *.merlion.com ; style-src 'self' *.merlion.com 'unsafe-inline' ; default-src 'none' ; strict-mixed-content-checking; reflected-xss filter; referrer origin-when-cross-origin; Last-Modified: Wed, 19 Apr 2017 03:13:25 GMT HTTP/1.1 200 OK Content-Type: text/html; charset=windows-1251 Access-Control-Allow-Origin: http://buro.ddix.ru Access-Control-Allow-Methods: GET, POST, OPTIONS Connection: keep-alive Server: nginx X-Content-Type-Options: nosniff Cache-Control: post-check=0, pre-check=0 Date: Wed, 19 Apr 2017 03:08:17 GMT Cache-Control: no-store, no-cache, must-revalidate Expires: Sat, 03 Aug 2013 00:00:00 GMT X-XSS-Protection: 1; mode=block