Content-Security-Policy-Report-Only: img-src 'none'; report-uri /endpoint