prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  Localhost not loading in Firefox
  Just found this problem in Firefox while setting up Gratipay locally on @dmk246 laptop. For some reason the page never loads when you `make run` and try to open localhost:8537 in Firefox it hangs. We believe it is because `gratipay.report_uri.io` 
  
  </issue>
  <code>
  [start of gratipay/security/__init__.py]
  1 from aspen import Response
  2 
  3 
  4 _requesting_asset = lambda r: r.path.raw.startswith('/assets/')
  5 
  6 
  7 def only_allow_certain_methods(request):
  8     method = request.method.upper()
  9     whitelist = ('GET', 'HEAD') if _requesting_asset(request) else ('GET', 'HEAD', 'POST')
  10     # POSTing to /assets/ interferes with the csrf.* functions if we're not careful
  11     if method not in whitelist:
  12         raise Response(405)
  13 
  14 
  15 def add_headers_to_response(response):
  16     """Add security headers.
  17     """
  18 
  19     # http://en.wikipedia.org/wiki/Clickjacking#X-Frame-Options
  20     if 'X-Frame-Options' not in response.headers:
  21         response.headers['X-Frame-Options'] = 'SAMEORIGIN'
  22     elif response.headers['X-Frame-Options'] == 'ALLOWALL':
  23 
  24         # ALLOWALL is non-standard. It's useful as a signal from a simplate
  25         # that it doesn't want X-Frame-Options set at all, but because it's
  26         # non-standard we don't send it. Instead we unset the header entirely,
  27         # which has the desired effect of allowing framing indiscriminately.
  28         #
  29         # Refs.:
  30         #
  31         #   http://en.wikipedia.org/wiki/Clickjacking#X-Frame-Options
  32         #   http://ipsec.pl/node/1094
  33 
  34         del response.headers['X-Frame-Options']
  35 
  36     # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
  37     if 'X-Content-Type-Options' not in response.headers:
  38         response.headers['X-Content-Type-Options'] = 'nosniff'
  39 
  40     # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
  41     if 'X-XSS-Protection' not in response.headers:
  42         response.headers['X-XSS-Protection'] = '1; mode=block'
  43 
  44     # https://www.w3.org/TR/referrer-policy/
  45     if 'Referrer-Policy' not in response.headers:
  46         response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
  47 
  48     # https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
  49     if 'content-security-policy-report-only' not in response.headers:
  50         response.headers['content-security-policy-report-only'] = (
  51             "default-src 'self';"
  52             "script-src 'self' assets.gratipay.com 'unsafe-inline';"
  53             "style-src 'self' assets.gratipay.com downloads.gratipay.com cloud.typography.com;"
  54             "img-src *;"
  55             "font-src 'self' assets.gratipay.com cloud.typography.com data:;"
  56             "upgrade-insecure-requests;"
  57             "block-all-mixed-content;"
  58             "reflected-xss block;"
  59             "report-uri https://gratipay.report-uri.io/r/default/csp/reportOnly;"
  60         )
  61
  [end of gratipay/security/__init__.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/gratipay/security/__init__.py b/gratipay/security/__init__.py
  --- a/gratipay/security/__init__.py
  +++ b/gratipay/security/__init__.py
  @@ -43,7 +43,8 @@
   
       # https://www.w3.org/TR/referrer-policy/
       if 'Referrer-Policy' not in response.headers:
  -        response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
  +        response.headers['Referrer-Policy'] = \
  +                                      'no-referrer-when-downgrade, strict-origin-when-cross-origin'
   
       # https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
       if 'content-security-policy-report-only' not in response.headers:
  @@ -53,8 +54,6 @@
               "style-src 'self' assets.gratipay.com downloads.gratipay.com cloud.typography.com;"
               "img-src *;"
               "font-src 'self' assets.gratipay.com cloud.typography.com data:;"
  -            "upgrade-insecure-requests;"
               "block-all-mixed-content;"
  -            "reflected-xss block;"
               "report-uri https://gratipay.report-uri.io/r/default/csp/reportOnly;"
           )
  
verification_info: {"golden_diff": "diff --git a/gratipay/security/__init__.py b/gratipay/security/__init__.py\n--- a/gratipay/security/__init__.py\n+++ b/gratipay/security/__init__.py\n@@ -43,7 +43,8 @@\n \n     # https://www.w3.org/TR/referrer-policy/\n     if 'Referrer-Policy' not in response.headers:\n-        response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'\n+        response.headers['Referrer-Policy'] = \\\n+                                      'no-referrer-when-downgrade, strict-origin-when-cross-origin'\n \n     # https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP\n     if 'content-security-policy-report-only' not in response.headers:\n@@ -53,8 +54,6 @@\n             \"style-src 'self' assets.gratipay.com downloads.gratipay.com cloud.typography.com;\"\n             \"img-src *;\"\n             \"font-src 'self' assets.gratipay.com cloud.typography.com data:;\"\n-            \"upgrade-insecure-requests;\"\n             \"block-all-mixed-content;\"\n-            \"reflected-xss block;\"\n             \"report-uri https://gratipay.report-uri.io/r/default/csp/reportOnly;\"\n         )\n", "issue": "Localhost not loading in Firefox\nJust found this problem in Firefox while setting up Gratipay locally on @dmk246 laptop. For some reason the page never loads when you `make run` and try to open localhost:8537 in Firefox it hangs. We believe it is because `gratipay.report_uri.io` \n", "before_files": [{"content": "from aspen import Response\n\n\n_requesting_asset = lambda r: r.path.raw.startswith('/assets/')\n\n\ndef only_allow_certain_methods(request):\n    method = request.method.upper()\n    whitelist = ('GET', 'HEAD') if _requesting_asset(request) else ('GET', 'HEAD', 'POST')\n    # POSTing to /assets/ interferes with the csrf.* functions if we're not careful\n    if method not in whitelist:\n        raise Response(405)\n\n\ndef add_headers_to_response(response):\n    \"\"\"Add security headers.\n    \"\"\"\n\n    # http://en.wikipedia.org/wiki/Clickjacking#X-Frame-Options\n    if 'X-Frame-Options' not in response.headers:\n        response.headers['X-Frame-Options'] = 'SAMEORIGIN'\n    elif response.headers['X-Frame-Options'] == 'ALLOWALL':\n\n        # ALLOWALL is non-standard. It's useful as a signal from a simplate\n        # that it doesn't want X-Frame-Options set at all, but because it's\n        # non-standard we don't send it. Instead we unset the header entirely,\n        # which has the desired effect of allowing framing indiscriminately.\n        #\n        # Refs.:\n        #\n        #   http://en.wikipedia.org/wiki/Clickjacking#X-Frame-Options\n        #   http://ipsec.pl/node/1094\n\n        del response.headers['X-Frame-Options']\n\n    # https://www.owasp.org/index.php/List_of_useful_HTTP_headers\n    if 'X-Content-Type-Options' not in response.headers:\n        response.headers['X-Content-Type-Options'] = 'nosniff'\n\n    # https://www.owasp.org/index.php/List_of_useful_HTTP_headers\n    if 'X-XSS-Protection' not in response.headers:\n        response.headers['X-XSS-Protection'] = '1; mode=block'\n\n    # https://www.w3.org/TR/referrer-policy/\n    if 'Referrer-Policy' not in response.headers:\n        response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'\n\n    # https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP\n    if 'content-security-policy-report-only' not in response.headers:\n        response.headers['content-security-policy-report-only'] = (\n            \"default-src 'self';\"\n            \"script-src 'self' assets.gratipay.com 'unsafe-inline';\"\n            \"style-src 'self' assets.gratipay.com downloads.gratipay.com cloud.typography.com;\"\n            \"img-src *;\"\n            \"font-src 'self' assets.gratipay.com cloud.typography.com data:;\"\n            \"upgrade-insecure-requests;\"\n            \"block-all-mixed-content;\"\n            \"reflected-xss block;\"\n            \"report-uri https://gratipay.report-uri.io/r/default/csp/reportOnly;\"\n        )\n", "path": "gratipay/security/__init__.py"}]}