comment out report_only: true

README.md

@@ -78,7 +78,7 @@ SecureHeaders::Configuration.default do |config|
   ]
   config.csp = {
     # "meta" values. these will shaped the header, but the values are not included in the header.
-    report_only: true,      # default: false [DEPRECATED from 3.5.0: instead, configure csp_report_only]
+    # report_only: true,      # default: false [DEPRECATED from 3.5.0: instead, configure csp_report_only]
     preserve_schemes: true, # default: false. Schemes are removed from host sources to save bytes and discourage mixed content.
 
     # directive values: these values will directly translate into source directives