Safari 7+ uses Content-Security-Policy