zladuric

# Security headers
# HSTS. Tell the browser only to access via https, and include subdomains as well.
add_header Strict-Transport-Security "max-age=2592000; includeSubDomains; preload";
# Tell the browser not to include our page as a frame in other pages.
add_header X-Frame-Options DENY;
# Tell the browser not to guess what type the file is
add_header X-Content-Type-Options nosniff;
## Tell the browser to only execute scripts included from our domain or www.some-analytics.com
add_header Content-Security-Policy "default-src 'self' www.some-analytics.com;";
# Cross site prot headers. Block rendering if CSS detected.

zladuric

'use strict';
window.onload = function() {
  const TILE_TYPES = {
    FULL: 'full',
    EMPTY: 'empty',
    HALF_FULL: 'half-full',
  };
  const template = document.getElementById('tile');
  class TileElement extends HTMLElement {
    connectedCallback () {