Questão 1207683

add_header Access-Control-Allow-Origin *;

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";

add_header Content-Security-Policy "default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval';" always;

add_header Cache-Control "max-age=0, no-cache, no-store, must-revalidate";

add_header X-Frame-Options "SAMEORIGIN" always;