no-referrer: PASS
origin: PASS
unsafe-url: PASS