TEST: no environmentmap, /test/* — no CSP, no nosniff

The classic USDZ with no environmentmap attribute, no security headers.