HTTP/1.1 200 OK
Date: Sun, 20 Oct 2019 15:48:01 GMT
Server: Apache
X-Powered-By: PHP/7.2.22
X-Pingback: https://www.firsthandfoundation.org/xmlrpc.php
Link: <https://www.firsthandfoundation.org/wp-json/>; rel="https://api.w.org/", <https://www.firsthandfoundation.org/>; rel=shortlink
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE, PUT
Access-Control-Max-Age: 1000
Access-Control-Allow-Headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
Vary: Accept-Encoding
Cache-Control: max-age=0, no-transform
Expires: Sun, 20 Oct 2019 15:48:01 GMT
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: default-src 'none'; img-src 'self' data: *.typekit.net *.blackbaudhosting.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com *.gstatic.com *.gravatar.com *.jquery.com *.w.org; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.typekit.net *.blackbaudhosting.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com *.gstatic.com; style-src 'self' 'unsafe-inline' data: *.typekit.net *.blackbaudhosting.com *.google.com *.googleapis.com *.gstatic.com *.jquery.com; font-src 'self' data: *.typekit.net *.googleapis.com *.gstatic.com; frame-src 'self' *.google.com *.googleapis.com *.gstatic.com *.youtube.com *.blackbaudhosting.com *.azurewebsites.net *.issuu.com; connect-src 'self' *.typekit.net *.googleapis.com *.gstatic.com; media-src 'self'; manifest-src 'self'
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Connection: close
Content-Type: text/html; charset=UTF-8