access-control-allow-credentials: true Server: nginx/1.12.1 x-request-id: 7rr1clp23o1sk3ea5rodlnat1pdfth9p Strict-Transport-Security: max-age=63072000; includeSubDomains Content-Length: 78384 x-xss-protection: 1; mode=block access-control-expose-headers: Connection: keep-alive set-cookie: festival=on; path=/; expires=Sat, 02 Jun 2018 02:11:32 GMT; max-age=15552000; HttpOnly access-control-allow-origin: null x-app-version: 0.0.8-5fe374f0 HTTP/1.1 200 OK x-frame-options: SAMEORIGIN X-Frame-Options: DENY Content-Type: text/html; charset=utf-8 X-Content-Type-Options: nosniff cache-control: max-age=0, private, must-revalidate x-content-type-options: nosniff vary: Origin Date: Mon, 04 Dec 2017 02:11:32 GMT