This page has CSP header.
xss: