1. manifest: serviceworker: src

  2. headers http header: content-security-policy: worker-src