/testing/web-platform/meta/mixed-content/blockable/meta-csp/
../
cross-origin-http
same-host-http