title: Mozilla Observatory does not recognize my CSP header
body: <p>I checked my website on <a href="https://observatory.mozilla.org/analyze.html?host=michael.walter.berlin" rel="nofollow">https://observatory.mozilla.org/analyze.html?host=michael.walter.berlin</a> and it is permamently saying that I did not implement a CSP-Header. I implemented it, which can be seen in the headers in Google Chrome and even on the website of Mozilla.</p>
  
  <p>My .htaccess is setting the headers and looks like this:</p>
  
  <pre><code>[...]
  Header set X-Content-Security-Policy "default-src 'self';style-src 'self' https://fonts.googleapis.com;font-src 'self' https://fonts.gstatic.com;script-src 'self' https://oss.maxcdn.com;"
  [...]
  </code></pre>
  
  <p>The output from mozilla's observatory is</p>
  
  <pre><code>X-Content-Security-Policy: default-src 'self';style-src 'self' https://fonts.googleapis.com;font-src 'self' https://fonts.gstatic.com;script-src 'self' https://oss.maxcdn.com;
  </code></pre>
  
  <p>The CSP-Header is recognized from my browser and shows errors in the console when I am violating these rules.</p>
  
  <p>Can anyone tell me what I am doing wrong? 
  Thanks in advance.</p>