meta http-equiv="Content-Security-Policy" content=" default-src 'self' ajax.googleapis.com *.youtube.com; script-src 'unsafe-hashes' 'sha256-{HASHED_EVENT_HANDLER}'; img-src *;" />