header

The Content-Security-Policy for the view (§"Content Security Policy Enforcement"). Only well-formed origins are kept, so a server cannot inject directives or keywords.