Content-Security-Policy: default-src 'self'; script-src 'none'; object-src 'none'; Content-Type: text/html
${TREE_ID}