HTTP/2 200 cache-control: public, max-age=31536000 content-security-policy: script-src www.viator.com widget.getyourguide.com static.ada.support *.getsitecontrol.com *.hotjar.com *.hotjar.io 'self' 'unsafe-inline' 'unsafe-eval' stats.g.doubleclick.net sdk.joinsherpa.io sdk.joinsherpa.com *.stripe.com cdn.cookielaw.org *.google-analytics.com cdn.amplitude.com *.googletagmanager.com geolocation.onetrust.com; img-src *.hotjar.com *.hotjar.io 'self' data: *; frame-src 'self' www.viator.com widget.getyourguide.com pay.joinsherpa.com sherpa.ada.support *.hotjar.com *.hotjar.io map.joinsherpa.io apps.joinsherpa.io apps.joinsherpa.com sherpa-widget.joinsherpa.io visas.joinsherpa.com sherpa-widget.joinsherpa.com *.stripe.com *.googletagmanager.com *.rapyd.net content-type: text/html; charset=UTF-8 etag: W/"1a87e-197f44b8f10" last-modified: Thu, 10 Jul 2025 12:24:42 GMT permissions-policy: accelerometer=(), camera=(self "https://apps.joinsherpa.io" "https://apps.joinsherpa.com" "https://sherpa-widget.joinsherpa.io" "https://visas.joinsherpa.com" "https://sherpa-widget.joinsherpa.com"), geolocation=(), gyroscope=(), microphone=(), usb=() referrer-policy: strict-origin-when-cross-origin server: Google Frontend strict-transport-security: max-age=31536000; includeSubDomains x-cloud-trace-context: 65e694a185d202eeea668e30c62e25d2 x-content-type-options: nosniff x-country-code: IN x-frame-options: DENY x-powered-by: Express accept-ranges: bytes date: Mon, 14 Jul 2025 15:01:47 GMT x-served-by: cache-bom4750-BOM x-cache: MISS x-cache-hits: 0 x-timer: S1752505306.182128,VS0,VE984 vary: cookie,need-authorization, x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 content-length: 108670