HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Content-Security-Policy: frame-ancestors 'self' x-frame-options: SAMEORIGIN X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Date: Sun, 28 Dec 2025 10:50:53 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: upgrade-insecure-requests; frame-ancestors 'self' https://*.ed.gov https://*.ed.gov; script-src 'self' 'unsafe-eval' 'unsafe-inline' https:; object-src 'self' 'unsafe-eval' 'unsafe-inline' https:; script-src-elem 'unsafe-inline' blob: https:; X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1615 Connection: Keep-Alive