How to use Content-Security-Policy-Report-Only to test your policy before enforcement. Working examples with report endpoints.