TEST: no environmentmap — normal security headers

The classic USDZ with no environmentmap attribute; CSP and nosniff apply.