HTTP/2 200 
x-timer: S1746800231.275941,VS0,VE2663
x-frame-options: SAMEORIGIN
pragma: cache
traceresponse: 00-183de18e2ec89610d82e040f7dfce674-d7cb5a0f80c9ae90-01
report-to: {"group":"report-endpoint","max_age":10886400,"endpoints":[{"url":"https:\/\/google.com"}]}
content-security-policy: font-src *.googleapis.com *.gstatic.com *.modiface.com *.loreal.io *.fontawesome.com fonts.gstatic.com *.livechatinc.com cdn.cookie-script.com maxcdn.bootstrapcdn.com https://fonts.gstatic.com 'self' data: *.stripe.com *.stripecdn.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.link.com *.amazon.com data: 'self' 'unsafe-inline'; form-action pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com www.facebook.com cdn.cookie-script.com 'self' 'unsafe-inline'; frame-ancestors www.gstatic.com *.stripe.com stripe.com *.link.com *.amazon.com 'self'; frame-src bid.g.doubleclick.net *.youtube.com *.youtube-nocookie.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com https://www.google.com/recaptcha/ www.googletagmanager.com *.instagram.com www.google.com *.affirm.com *.affirm.ca vars.hotjar.com secure.livechatinc.com www.facebook.com socialplugin.facebook.net 'unsafe-inline' duosecurity.com api-37884245.duosecurity.com *.attn.tv *.doubleclick.net cdn.cookie-script.com https://player.vimeo.com https://www.youtube-nocookie.com *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.link.com *.amazon.com *.weltpixel.com 'self' 'unsafe-inline'; img-src widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com *.youtube.com *.googleapis.com *.gstatic.com *.cdninstagram.com *.affirm.com *.affirm.ca blueskytechmage.com mageblueskytech.com placehold.jp https://static.klaviyo.com https://static-forms.klaviyo.com https://fast.a.klaviyo.com https://static-tracking.klaviyo.com/ https://a.klaviyo.com/ https://telemetrics.klaviyo.com/ *.modiface.com *.loreal.io *.laroche-posay.us *.vichyusa.com scontent-atl3-2.cdninstagram.com/ visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com www.facebook.com pushcrew.com cdn.pushcrew.com tracking.pushcrew.com bat.bing.com *.cloudfront.net www.google.ca amcglobal.sc.omtrdc.net cdn.cookie-script.com flagpedia.net blob: https://updates.themepunch.tools http://updates.themepunch.tools https://updates.themepunch-ext-a.tools http://updates.themepunch-ext-a.tools https://updates.themepunch-ext-b.tools http://updates.themepunch-ext-b.tools https://dev.sliderrevolution.com https://revolution.themepunch.com http://revolution5.themepunch.com http://pbs.twimg.com https://pbs.twimg.com http://scontent.cdninstagram.com https://img.youtube.com http://live.staticflickr.com https://live.staticflickr.com data: 'self' 'unsafe-inline'; script-src www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ *.googleapis.com *.gstatic.com *.instagram.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ *.affirm.com *.affirm.ca *.attn.tv events.attentivemobile.com https://static.klaviyo.com https://static-forms.klaviyo.com https://fast.a.klaviyo.com https://static-tracking.klaviyo.com/ https://a.klaviyo.com/ https://telemetrics.klaviyo.com/ *.modiface.com *.loreal.io cdn.livechatinc.com api.livechatinc.com secure.livechatinc.com pushcrew.com cdn.pushcrew.com connect.facebook.net static.hotjar.com script.hotjar.com www.clickcease.com visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com *.cloudfront.net waves.retentionscience.com bat.bing.com www.youtube.com 'unsafe-inline' cdn.cookie-script.com js-agent.newrelic.com s7.addthis.com maps.googleapis.com https://player.vimeo.com https://www.youtube.com *.stripe.com *.stripe.network *.stripecdn.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.amazon.com *.link.com https://www.googletagmanager.com tagmanager.google.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src fonts.googleapis.com https://static.klaviyo.com *.fontawesome.com pushcrew.com cdn.pushcrew.com www.googletagmanager.com cdn.cookie-script.com maxcdn.bootstrapcdn.com *.gstatic.com https://fonts.googleapis.com http://fonts.googleapis.com *.stripe.network *.stripecdn.com *.amazon.com tagmanager.google.com 'self' 'unsafe-inline'; object-src 'self' 'unsafe-inline'; media-src *.cdninstagram.com *.modiface.com *.loreal.io blob: 'self' 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; connect-src www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com *.googleapis.com *.affirm.com *.affirm.ca *.attn.tv events.attentivemobile.com https://static.klaviyo.com https://static-forms.klaviyo.com https://fast.a.klaviyo.com https://static-tracking.klaviyo.com/ https://a.klaviyo.com/ https://telemetrics.klaviyo.com/ *.modiface.com *.loreal.io dc.services.visualstudio.com api.livechatinc.com monitor.clickcease.com visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com in.hotjar.com *.hotjar.io stats.g.doubleclick.net *.hotjar.com wss://*.hotjar.com *.facebook.net *.google.com *.attentivemobile.com *.googlesyndication.com cdn.cookie-script.com consent.cookie-script.com googleads.g.doubleclick.net ekr.zdassets.com/ www.gstatic.com maps.googleapis.com https://fonts.googleapis.com https://fonts.gstatic.com https://api.weatherbit.io *.stripe.com klarna.com *.klarna.com *.klarnacdn.net *.klarnaevt.com *.link.com *.amazon.com *.google-analytics.com 'self' 'unsafe-inline'; child-src http: https: blob: 'self' 'unsafe-inline'; default-src 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline'; report-uri https://google.com; report-to report-endpoint;
x-content-type-options: nosniff
x-debug-info: eyJyZXRyaWVzIjowfQ==
content-type: text/html; charset=UTF-8
x-platform-server: i-098889433f83bf933
x-platform-server: i-098889433f83bf933
expires: Sat, 10 May 2025 14:17:11 GMT
x-xss-protection: 1; mode=block
content-encoding: gzip
accept-ranges: bytes
age: 37
date: Fri, 09 May 2025 14:17:51 GMT
x-served-by: cache-yul1970024-YUL, cache-yul1970024-YUL, cache-mci680052-MCI
x-cache: MISS, HIT, MISS
x-cache-hits: 0, 3, 0
cache-control: no-store, no-cache, must-revalidate, max-age=0
vary: Accept-Encoding,Cookie
strict-transport-security: max-age=31557600
content-length: 49475