HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 44376
Connection: keep-alive
Date: Mon, 22 Jul 2019 16:10:41 GMT
Server: nginx/1.12.1
Cache-Control: max-age=150, must-revalidate, stale-while-revalidate=86400
Pragma: 
Last-Modified: Mon, 22 Jul 2019 16:08:31 GMT
Expires: Mon, 22 Jul 2019 16:11:09 GMT
MyServerID: silverstripe-base-
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=2592000
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com *.google.com *.vimeo.com *.spotify.com *.google-analytics.com *.twitter.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' googleads.g.doubleclick.net *.googleapis.com secure.adnxs.com *.fiftyt.com *.abmr.net *.mathtag.com *.gstatic.com *.akamaihd.net *.typekit.net *.googletagmanager.com track.adform.net *.facebook.net *.google.com *.browsealoud.com *.youtube.com s.ytimg.com static.hotjar.com script.hotjar.com *.google-analytics.com s7.addthis.com secure-ds.serving-sys.com secure.quantserve.com bs.serving-sys.com m.addthisedge.com *.addthis.com *.bugherd.com *.quantcount.com *.vimeocdn.com *.avocet.io *.venuefinder.com *.googleadservices.com *.myloap.com *.pictdog.com *.googlesyndication.com *.ctnsnet.com; style-src 'self' 'unsafe-inline' 'unsafe-eval' *.google.com *.browsealoud.com *.googleapis.com *.doubleclick.net *.addthis.com *.trendmicro.com; img-src 'self' sadlerswells-assets-dev.s3.amazonaws.com visitor.fiftyt.com *.mathtag.com sadlerswells-assets.s3.amazonaws.com sadlerswells-downloads.s3-eu-west-1.amazonaws.com sadlerswells-assets.s3.amazonaws.com *.s3.amazonaws.com s3.amazonaws.com *.akamaihd.net *.facebook.com *.typekit.net *.google-analytics.com stats.g.doubleclick.net *.googleapis.com *.google.com *.google.co.uk *.googletagmanager.com *.browsealoud.com *.quantserve.com *.gstatic.com *.addthis.com *.vimeocdn.com *.teads.tv tfl.gov.uk i.ytimg.com *.hotjar.com wss://*.hotjar.com; font-src 'self' *.typekit.net *.gstatic.com *.hotjar.com wss://*.hotjar.com; connect-src 'self' www.facebook.com *.akamaihd.net in.hotjar.com *.hotjar.com wss://*.hotjar.com *.browsealoud.com *.typekit.net *.google-analytics.com secure-ds.serving-sys.com *.texthelp.com *.speechstream.net *.addthis.com *.doubleclick.net campaigns.mail2app.lynch2.com *.hotjar.com; media-src 'self' *.speechstream.net; object-src 'self' *.venuefinder.com *.brightcove.com; child-src 'self'; frame-src 'self' secure.sadlerswells.com servedby.flashtalking.com *.fls.doubleclick.net *.mathtag.com securesadlerswells.s3-eu-west-1.amazonaws.com 8739830.fls.doubleclick.net vars.hotjar.com  *.addthis.com *.google.com my.matterport.com *.youtube.com *.google.com *.vimeo.com *.spotify.com *.google-analytics.com *.twitter.com *.soundcloud.com resources.ehouse.co.uk e.issuu.com *.brightcove.net; worker-src 'self'; frame-ancestors 'self' secure.sadlerswells.com; form-action 'self' secure.sadlerswells.com *.wordfly.com; upgrade-insecure-requests; block-all-mixed-content; reflected-xss block; report-uri https://sadlerswells.report-uri.com/r/d/csp/enforce;
X-Cache-Status: HIT
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 891b1deb65550a4f9d40f2585712c586.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DFW3-C1
X-Amz-Cf-Id: zafnd0jMSLMVvjL_zk5txiFLuJGXToUH_kdl_P1YCP8Ztmti8D85Nw==