anchor.diff:      <p>Each response header can be called in an unprotected and in a protected version. Every header is added via a
       filter.</p>
   
  +    <a href="form.jsp">Base form</a>
  +
       <h2>X-Frame-Options</h2>
       <p>
  -        <a href="x-frame-options/unprotected.jsp">Unprotected</a><br>
  +        <a href="x-frame-options/unprotected.jsp">Unprotected</a><br/>
           <a href="x-frame-options/protected.jsp">Protected</a>
       </p>
   
  
positive.code:     <h2>Content Security Policy</h2>
      <p>
          <a href="csp/unprotected.jsp">Unprotected</a><br>
          <a href="csp/protected.jsp">Protected</a>
          <a href="csp/protected-report-only.jsp">Protected (Reporting only)</a>
      </p>
  </body>
  
negative.code: <html>
  <head>
  	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <link rel="stylesheet" type="text/css" href="resources/css/styles.css" />
  	<title>Security Response Header</title>
  </head>
  <body>
  