Server: Apache Content-Security-Policy: default-src * 'self' https: data: 'unsafe-inline' 'unsafe-eval'; connect-src * 'self' https: data: 'unsafe-inline' 'unsafe-eval'; child-src * 'self' https: 'unsafe-inline' 'unsafe-eval'; script-src * 'self' https: 'unsafe-inline' 'unsafe-eval'; media-src * 'self' https: HTTP/1.1 200 OK X-Powered-By: PHP/5.6.30 Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Date: Mon, 12 Jun 2017 19:25:21 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Content-Type: text/html; charset=UTF-8 Set-Cookie: myapp=b8e4418e099bee2cd956930caf31f049; expires=Mon, 12-Jun-2017 20:25:21 GMT; Max-Age=3600; path=/; HttpOnly Set-Cookie: myapp=d050454fbf662b3bba3e195d885d04f0; expires=Mon, 12-Jun-2017 20:25:21 GMT; Max-Age=3600; path=/; HttpOnly Transfer-Encoding: chunked Pragma: no-cache