HTTP/1.1 200 OK
Server: Rocket
Date: Tue, 30 Jul 2019 17:04:06 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=120
Vary: Accept-Encoding
Etag: W/"5d40018a-57f3"
Last-Modified: Tue, 30 Jul 2019 08:36:26 GMT
Strict-Transport-Security: max-age=2592000
Content-Security-Policy: upgrade-insecure-requests
Content-Security-Policy-Report-Only: default-src 'self' 'unsafe-inline' data: *.scot.nhs.uk *.google.com *.googleapis.com *.gstatic.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.facebook.com connect.facebook.net *.twitter.com *.twimg.com www.youtube.com yui.yahooapis.com cdnjs.cloudflare.com maxcdn.bootstrapcdn.com code.jquery.com s3.amazonaws.com *.browsealoud.com use.fontawesome.com *.addthis.com use.typekit.net; font-src 'self' data: fonts.gstatic.com use.fontawesome.com use.typekit.net; form-action 'self' syndication.twitter.com; report-uri https://web-reports.scot.nhs.uk/api/v1/csp-report; report-to csp-endpoint
X-XSS-Protection: 0
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Feature-Policy: camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; usb 'none'
Expect-CT: enforce, max-age=604800, report-uri="https://web-reports.scot.nhs.uk/api/v1/expect-ct-report"
Report-To: {'endpoints': [{'url': 'https://showteam.report-uri.com/a/d/g'}], 'group': 'default', 'include_subdomains': false, 'max-age': 30}, {'endpoints': [{'url': 'https://web-reports.scot.nhs.uk/api/v1/csp-report'}], 'group': 'csp-endpoint', 'include_subdomains': false, 'max-age': 604800}
NEL: {"include_subdomains": false, "max_age": 30, "report_to": "default"}
Cache-Control: no-transform