This is an IFrame sending a Content Security Policy header containing "{{GET[policy]}}".