handle($request, []); self::assertSame(200, $response->status); self::assertStringContainsString('text/html', $response->headers['Content-Type'] ?? ''); self::assertSame('nosniff', $response->headers['X-Content-Type-Options']); self::assertStringContainsString('default-src', $response->headers['Content-Security-Policy']); self::assertStringContainsString('', $response->body); } }