def add_headers_to_response(response):
 if ('X-Frame-Options' not in response.headers):
  response.headers['X-Frame-Options'] = 'SAMEORIGIN'
 elif (response.headers['X-Frame-Options'] == 'ALLOWALL'):
  del response.headers['X-Frame-Options']
 if ('X-Content-Type-Options' not in response.headers):
  response.headers['X-Content-Type-Options'] = 'nosniff'
 if ('X-XSS-Protection' not in response.headers):
  response.headers['X-XSS-Protection'] = '1; mode=block'
 if ('content-security-policy-report-only' not in response.headers):
  response.headers['content-security-policy-report-only'] = "default-src 'self';script-src 'self' assets.gratipay.com 'unsafe-inline';style-src 'self' assets.gratipay.com downloads.gratipay.com cloud.typography.com;img-src *;font-src 'self' assets.gratipay.com cloud.typography.com data:;upgrade-insecure-requests;block-all-mixed-content;reflected-xss block;report-uri https://gratipay.report-uri.io/r/default/csp/reportOnly;"

def add_headers_to_response ( response ) : if ( 'X-Frame-Options' not in response . headers ) : response . headers [ 'X-Frame-Options' ] = 'SAMEORIGIN' elif ( response . headers [ 'X-Frame-Options' ] == 'ALLOWALL' ) : del response . headers [ 'X-Frame-Options' ] if ( 'X-Content-Type-Options' not in response . headers ) : response . headers [ 'X-Content-Type-Options' ] = 'nosniff' if ( 'X-XSS-Protection' not in response . headers ) : response . headers [ 'X-XSS-Protection' ] = '1; mode=block' if ( 'content-security-policy-report-only' not in response . headers ) : response . headers [ 'content-security-policy-report-only' ] = "default-src 'self';script-src 'self' assets.gratipay.com 'unsafe-inline';style-src 'self' assets.gratipay.com downloads.gratipay.com cloud.typography.com;img-src *;font-src 'self' assets.gratipay.com cloud.typography.com data:;upgrade-insecure-requests;block-all-mixed-content;reflected-xss block;report-uri https://gratipay.report-uri.io/r/default/csp/reportOnly;"
add security headers .