anchor.diff:  | Description
   | Default
   
  -| mode (CSP Mode)
  +| mode
   | Enum [ENABLED, REPORT_ONLY, DISABLED]
  -| Which content security policy mode to use.
  +a| .CSP Mode
  +Which content security policy mode to use.
   | DISABLED
   
  -| csp (Content Security Policy Definition)
  +| csp
   | String
  -| A valid CSP definition to apply
  +a| .Content Security Policy
  +A valid CSP definition to apply
   | Empty string
  -
  -|===
  -
  -[cols="2,1,4,1", options="header"]
  -.Other Configuration Options
  -|===
  -
  -| Option
  -| Type
  -| Description
  -| Default
  -
  -| frameOptions (Frame Options)
  -| Enum [DENY, SAMEORIGIN, DISABLED]
  -| Defines if, or how, a resource should be displayed in a frame, iframe or object.
  -| DISABLED
  -
  -| xssProtection (XSS Protection)
  -| Enum [OFF, ON, BLOCK, DISABLED]
  -| Enable or disable XSS filtering in the UA.
  -| DISABLED
  -
  -| contentTypeOptions
  -| Boolean
  -| X-Content-Type-Options: Prevent MIME-sniffing to any type other than the declared Content-Type.
  -| false
   
   |===
   
  
positive.code: 
  | enabled
  | Boolean
  | Enable HTTP Strict Transport (HSTS)
  | false
  
  | includeSubdomains
  
negative.code: {
      "groupId": "io.apiman.plugins",
      "artifactId": "apiman-plugins-cors-policy",
      "version": "1.2.5.Final" // Please check for the latest version, this is just an example.
  }
  ```
  
  ===== Configuration
  The configuration options available, are:
  
  .CORS policy configuration
  [cols="2,1,4,1", options="header"]
  |===
  | Option
  