anchor.diff:  the user-agent will send a violation report to the declared URL specified by the _report-uri_ directive,
   but still allow the violating resource to load nevertheless.
   
  +[[headers-csp-configure]]
   ===== Configuring Content Security Policy
   
   It's important to note that Spring Security *_does not add_* Content Security Policy by default.
  
positive.code: }
  ----
  
  ===== Additional Resources
  
  Applying Content Security Policy to a web application is often a non-trivial undertaking.
  
negative.code: }
  ----
  
  [[headers-csp]]
  ==== Content Security Policy (CSP)
  
  https://www.w3.org/TR/CSP2/[Content Security Policy (CSP)] is a mechanism that web applications can leverage to mitigate content injection vulnerabilities,
  