HTTP/1.1 200 OK
Date: Sat, 12 Dec 2020 15:04:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d1134e24a9018adecdbd407d63d9d145b1607785443; expires=Mon, 11-Jan-21 15:04:03 GMT; path=/; domain=.timetospa.com; HttpOnly; SameSite=Lax
Content-Security-Policy-Report-Only: font-src 'self' data: *.cloudflare.com *.bootstrapcdn.com smile-ui.smilecdn.co *.userway.org 'self' 'unsafe-inline'; form-action geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.authorize.net www.facebook.com 'self' 'unsafe-inline'; frame-ancestors 'self' 'unsafe-inline'; frame-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.google.com js.squareup.com pci-connect.squareup.com connect.squareup.com pci-connect.squareupsandbox.com https://js.squareupsandbox.com assets.braintreegateway.com player.vimeo.com www.youtube.com cdn.jst.ai cdn.iubenda.com *.addthisedge.com ssl.kaptcha.com www.facebook.com *.userway.org 'self' 'unsafe-inline'; img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com 'self' data: *.cloudflare.com a.klaviyo.com cdn.sweettooth.io *.cloudfront.net js.squareup.com www.google.com www.google.co.uk www.facebook.com *.userway.org *.cdninstagram.com www.xtento.com cdn.xtento.com 'self' 'unsafe-inline'; script-src assets.adobedtm.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.googleadservices.com www.google-analytics.com secure.authorize.net test.authorize.net www.paypal.com www.sandbox.paypal.com www.paypalobjects.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com js.authorize.net jstest.authorize.net js.braintreegateway.com www.youtube.com https://static.klaviyo.com https://fast.a.klaviyo.com *.cloudflare.com www.googletagmanager.com www.google.com www.gstatic.com cdn.iubenda.com cdn.sweettooth.io smile-ui.smilecdn.co js.squareup.com nd.squarecdn.com polyfill.io https://js.squareupsandbox.com *.cardinalcommerce.com *.iubenda.com connect.facebook.net cdn.jst.ai my.jst.ai analytics.jst.ai assets.zendesk.com static.zdassets.com js-agent.newrelic.com bam.nr-data.net *.addthisedge.com *.addthis.com www.google.co.uk *.affirm.com accessibilityserver.org cdn.userway.org *.userway.org www.xtento.com cdn.xtento.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src getfirebug.com *.fontawesome.com *.bootstrapcdn.com smile-ui.smilecdn.co js.squareup.com static.klaviyo.com *.userway.org 'self' 'unsafe-inline'; object-src 'self' 'unsafe-inline'; media-src static.zdassets.com *.userway.org 'self' 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; connect-src geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com https://static.klaviyo.com *.cloudflare.com *.googletagmanager.com www.google-analytics.com *.google.com a.klaviyo.com fast.a.klaviyo.com telemetrics.klaviyo.com cdn.iubenda.com platform.smile.io api-js.mixpanel.com web-analytics.smile.io js.squareup.com pci-connect.squareup.com pci-connect.squareupsandbox.com connect.squareup.com api.sandbox.braintreegateway.com payments.sandbox.braintree-api.com www.paypal.com origin-analytics-sand.sandbox.braintree-api.com ekr.zdassets.com onespaworld.zendesk.com wss://widget-mediator.zopim.com hits-i.iubenda.com bam.nr-data.net analytics.jst.ai stats.g.doubleclick.net payments.braintree-api.com client-analytics.braintreegateway.com *.algolia.net *.affirm.com *.userway.org graph.instagram.com 'self' 'unsafe-inline'; child-src 'self' 'unsafe-inline'; default-src 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Pragma: no-cache
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
CF-Cache-Status: DYNAMIC
cf-request-id: 06f91408f000004965de19a000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 600855ee48244965-STL