Connection-Allowlist: (response-origin)