TEST: USDZ served as model/vnd.pixar.usd — normal security headers

Same classic USDZ bytes, content-type matching webkit.org's demos; CSP and nosniff apply.