anchor.diff:      add_header Content-Security-Policy "default-src 'self';";
       add_header X-Content-Type-Options nosniff;
       add_header Permissions-Policy "camera=(); payment=(); microphone=(); gyroscope=(); magnetometer=(); midi=(); geolocation=()";
  -    add_header Referrer-Policy 'origin';
  +    add_header Referrer-Policy 'strict-origin';
         <% if @server_proto == 'https' %>
       add_header Strict-Transport-Security "max-age=<%= @helper.get_max_age_for_hsts %>; includeSubDomains";
         <% end %>
  
positive.code:       add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
        add_header Permissions-Policy "camera=(); payment=(); microphone=(); gyroscope=(); magnetometer=(); midi=(); geolocation=()";
        add_header Referrer-Policy 'origin';
      }
  
      location /version {
  
negative.code:       add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
        add_header Permissions-Policy "camera=(); payment=(); microphone=(); gyroscope=(); magnetometer=(); midi=(); geolocation=()";
        add_header Referrer-Policy 'strict-origin';
      }
  
      location "/css/" {
  