here — it would conflict with the nonce-bearing header and cause browsers to apply both (intersection = stricter). -->