mixed-content/csp.https.window.js.headers

Content-Security-Policy: sandbox allow-scripts allow-popups;