Cross-Origin-Opener-Policy: same-origin-allow-popups
Timing-Allow-Origin: *