HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:07 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=S9HMgiYD2ijpgKaM9x2IKZaT5gChHQCv7T6Z76NqFjYu2PZ1KyLBHlZYFSdTmUkclB27ij2BvuIME90RkpDyDR22wJuRLFRK7OFdU8Cysjaoujjp4r0onCHgKD6dyntE; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: text/html; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/2 200 OK
date: Fri, 10 May 2024 12:26:07 GMT
content-type: text/css; charset=utf-8
content-length: 5631
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e5f-7918"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 114047
expires: Wed, 30 Apr 2025 12:26:07 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dEDmCODzzYINQF5gGZTMOMMIopZT0ygNS34NH3o252TiQUUj4EfmyeNs9M%2Bi9rl4ppkq6BqasEo%2FnxodLaLmDTX7SWb3Ylunbgy0qlF1eoq1FBIJFS8zqevr%2FXw19Zu8wGJ%2BQwTR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8819ea73fbc956c7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

HTTP/2 200 OK
date: Fri, 10 May 2024 12:26:07 GMT
content-type: text/css; charset=utf-8
content-length: 2980
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fae-56b3"
last-modified: Mon, 04 May 2020 16:15:42 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 796929
expires: Wed, 30 Apr 2025 12:26:07 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TNt5%2ByVnpiLdVy%2F9gOFA2bhUg0wWqmCbCNiHcjO3gW%2FUebFn%2Fp9K%2Ff%2BotEvoTxNfWcQZu3vdNP4pzKkLClsI9X84F3lIiaEC89TRfsHCUlnd3EZNFHk5I%2BMRCn5e9DXphbht84uu"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8819ea740bd456c7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

HTTP/1.1 200 OK
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 10 May 2024 01:09:52 GMT
Last-Modified: Thu, 02 May 2024 22:10:31 GMT
ETag: W/"5401164ccd39fd5367254a85e0091059"
x-amz-server-side-encryption: AES256
x-amz-version-id: JdqPl35toFt00Gdy.vm.PExciTm2KLB.
Server: AmazonS3
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 185768229530368be94556dcab1c486a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: kUciDC398dkYj5vsVqLgyxcs8X2NLvehYW8IuLcUP_Z6tW6ScwGP1A==
Age: 40576

HTTP/2 200 OK
content-type: image/gif
content-length: 43
date: Fri, 10 May 2024 12:26:07 GMT
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
content-security-policy: object-src 'none'; frame-ancestors https://*.trustarc.com https://*.prod.internal.trustarc.com https://*.trustarc.eu https://*.prod.internal.trustarc.eu https://*.staging.internal.trustarc.com https://*.trustarc-svc.net https://*.truste-svc.net https://*.qa.truste-svc.net https://*.dev.truste-svc.net  http://localhost:* https://*.nymity.com https://*.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: cross-origin
expect-ct: enforce, max-age=60
permissions-policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-cache: Miss from cloudfront
via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: _Wy3BMaLz3gyC0i5mZb4TkGAvTa2eC3ziMeHAX1Mw-tZqLzKrAwmxA==
vary: Origin
X-Firefox-Spdy: h2

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:07 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: text/css; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/3 200 OK
date: Fri, 10 May 2024 12:26:07 GMT
content-type: application/octet-stream; charset=utf-8
content-length: 77160
access-control-allow-origin: *
cache-control: public, max-age=30672000
etag: "5eb03e5f-12d68"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 156700
expires: Wed, 30 Apr 2025 12:26:07 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=07AOLm6awhHHw%2FH9NHtUWUO7KbcE3Tos%2F6zUmgxaYGWvZaL1Q%2B6jAbL4TDT8YPwWYsWIQSyC%2Bvkq0qbasmC3tb6oBbQATeI9GfDdDc9ez7IR33ZUJoP1MqN7Xu%2FP1K7pEuA%2F7oLK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8819ea764e8fb517-OSL
alt-svc: h3=":443"; ma=86400

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 10 May 2024 06:08:19 GMT
expires: Sat, 10 May 2025 06:08:19 GMT
cache-control: public, max-age=31536000
age: 22668
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:07 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/javascript; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:07 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/javascript; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:07 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/javascript; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:07 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/javascript; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 10 May 2024 12:26:07 GMT
date: Fri, 10 May 2024 12:26:07 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:07 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/javascript; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:08 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/javascript; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:08 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/javascript; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:08 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/javascript; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:08 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/javascript; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:08 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/javascript; charset=UTF-8
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:09 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=dRbzUsb3sJfVm0mTYKkqOpfxVOXTlDqg9qFNoYRLJWzPdfQ2f1c9IbbZPO0ZiD23gI25UQnd3ur7gohRmvamhsr2CMMo0F_Pd5g9qB7XfSKYr2szShUJMKJiQ6PD7QTi; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/json;charset=UTF-8
access-control-allow-origin: https://spafinder-partner.blackhawknetwork.com
Vary: Origin,Accept-Encoding
access-control-allow-credentials: true
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:09 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=R~Dr2sgCkpPc1~1lTxsMw4wQ_l~og9_D~cAu04fD9Dubu5Shpy6skubJC57SDW2MgeIADVW7gvGlD3y_dZniusQy6_dyaY2gr4mXvc~RHxlhsWVQiR~HAwpx3wG9c_6y; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/json;charset=UTF-8
access-control-allow-origin: https://spafinder-partner.blackhawknetwork.com
Vary: Origin,Accept-Encoding
access-control-allow-credentials: true
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 
Date: Fri, 10 May 2024 12:26:08 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=~zZ2dyWbUwQ865eejcJ4FZaEdbU74mAFXU16mzYwUneFfkIkPEoMhi34bOey_g1TVr7ZkN2XLUsVoSK2llviAfOloKSj3fu30XDbjdmeQ0HlmWu6b7dKOiYU20~IuGm6; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Access-Control-Allow-Origin: https://spafinder-partner.blackhawknetwork.com
Access-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE
Vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
Allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
Content-Length: 0
Access-Control-Allow-Headers: Access-Control-Allow-Headers, Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, requestId, unique-id, merchantId, tenantId, certificateId, role, clientConfigId, *
Access-Control-Expose-Headers: *, *
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:09 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=2zU9jF4iCTYeJqa69aBzVydsgLQhe8CO9NQ4LpvrUoPQWXKA73XZJrpI21YVl2qBwU1Ct4fSZD9zLWMquC71ZedNc7nOdICj0M7u9pkSk4ko2igx1wzVkL631UIoTDgj; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/json;charset=UTF-8
access-control-allow-origin: https://spafinder-partner.blackhawknetwork.com
Vary: Origin,Accept-Encoding
access-control-allow-credentials: true
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/2 200 OK
content-type: image/gif
content-length: 43
date: Fri, 10 May 2024 12:26:09 GMT
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
content-security-policy: object-src 'none'; frame-ancestors https://*.trustarc.com https://*.prod.internal.trustarc.com https://*.trustarc.eu https://*.prod.internal.trustarc.eu https://*.staging.internal.trustarc.com https://*.trustarc-svc.net https://*.truste-svc.net https://*.qa.truste-svc.net https://*.dev.truste-svc.net  http://localhost:* https://*.nymity.com https://*.qanym;; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp-reporter.tools.trustarc-svc.net/report
cross-origin-embedder-policy: unsafe-none
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: cross-origin
expect-ct: enforce, max-age=60
permissions-policy: geolocation=(), camera=(), speaker=(), microphone=(), vibrate=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
x-cache: Miss from cloudfront
via: 1.1 d4fd24ae65d4d2b97cfdea8d2f0c21a6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: AeWr5rkmVmQ5olCSfIpBEOMpMIUtdwI5Ii0RmeAi1zDm92qP6hQKlA==
vary: Origin
X-Firefox-Spdy: h2

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:09 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=samSYxGyVLR6JIbGgKm3P8fNZBKDWgxi8tNrLJI2SSXjJT4ysSVcnWLTPnb1dbS2D25NQ_KoXRBtanonibwkJizgIolvv5_6Ol0P4ItA13Uw1wncKP5Dhd4UXkjVKFjY; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/json;charset=UTF-8
access-control-allow-origin: https://spafinder-partner.blackhawknetwork.com
Vary: Origin,Accept-Encoding
access-control-allow-credentials: true
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:09 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=BQ8EKm8Hb_vRTpX7RwpyIRsQOsSCEQhmqfyJR9SHRwWxOm5_64LMbg8PYCVbc6n9ZxX9_Ys~v1vehDwyVuqFjF_jmAYzm3v5k0XbN~NIOm8VByRWGVhRE~1zrqcRPU2K; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/json; charset=utf-8
Content-Length: 65
Vary: Accept-Encoding
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive

HTTP/1.1 200 
Date: Fri, 10 May 2024 12:26:08 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=iKCEc0r0nvGm1~0XxkvExyMItGhhpHW77kBmLtSAC1nabkhlMmNi6Iy75Fz1cc00OHfsu~7jwrfRGZTK_g1a6q_KNuXzobiPMCEzMBOqqOVsUDn2GxJHyVFac8Ze9VYy; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Access-Control-Allow-Origin: https://spafinder-partner.blackhawknetwork.com
Access-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE
vary: accept-encoding
Content-Encoding: gzip
Content-Type: application/json
Access-Control-Allow-Headers: Access-Control-Allow-Headers, Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, requestId, unique-id, merchantId, tenantId, certificateId, role, clientConfigId, *
Access-Control-Expose-Headers: *, *
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:09 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=px8yy1Qt1xI3NfHNqKZ1WR37NRq1Q42epklnviPlVfQjHFIYtuHgSI~L8A~UXGK9AezyZ27xU6o5YD4Ee36fpDgvNHzPdXEBkfiRhQtw2yuV5vNeXItODp1xlW7F5bZx; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/json;charset=UTF-8
access-control-allow-origin: https://spafinder-partner.blackhawknetwork.com
Vary: Origin,Accept-Encoding
access-control-allow-credentials: true
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:09 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=F3t1H3X1qI7813BzZfHYiHySIdmP6OqT~HAxE56B8Z8dg97zHr3JTXY32FB~Je4XhBt0xabkN0K9NUD_VEN2jIcZhc0Kx~CcX5U~tDOA3a8ZUoA1ptCk65ORjcR52jot; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/json;charset=UTF-8
access-control-allow-origin: https://spafinder-partner.blackhawknetwork.com
Vary: Origin,Accept-Encoding
access-control-allow-credentials: true
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:09 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=3XUBpet1ENE6QMgeSZgeQWre4GjckLnfCoEmy~gUNIkBI_bJbWXMWyfHuttlyoewMeSEgy5IrKvMR0vuaPwK6UxEdnXV4ZdRoG6mrAhDSrnjOAwf3hHoqJ_dI50Yu2CS; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/json;charset=UTF-8
access-control-allow-origin: https://spafinder-partner.blackhawknetwork.com
Vary: Origin,Accept-Encoding
access-control-allow-credentials: true
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 10 May 2024 12:26:10 GMT
expires: Fri, 10 May 2024 12:26:10 GMT
cache-control: private, max-age=900
last-modified: Fri, 10 May 2024 12:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 79168
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:10 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=CnhsKkcF_WcGzrOD1oXcay7CDuN7wbGq1oc9WMwgEFD93BnTzCs4XpsFB8azoGZqDu4Z6VL5mJVJFGfCJkfEhU1cTrPl8Dt9U90jjxtziTU0h4wPaL19SUywrMvl6vy0; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: application/json;charset=UTF-8
access-control-allow-origin: https://spafinder-partner.blackhawknetwork.com
Vary: Origin,Accept-Encoding
access-control-allow-credentials: true
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
Content-Encoding: gzip
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/2 200 OK
x-goog-generation: 1712675736703689
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 25029
content-encoding: gzip
content-language: en
x-goog-hash: crc32c=yFbKsg==, md5=CpdsJm+ute95411fNPD0wQ==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 25029
access-control-allow-origin: *
access-control-expose-headers: *
x-guploader-uploadid: ABPtcPqN9F_4YJqNtvGkDwAPjHdr9XEt1bk6BowQxXF-1yCuAuzy5hvdkD9AxdVzIF4994-lKQsWCVeEkg
server: UploadServer
date: Fri, 10 May 2024 12:12:26 GMT
expires: Fri, 10 May 2024 12:42:26 GMT
cache-control: public, max-age=1800,no-transform
age: 824
last-modified: Tue, 09 Apr 2024 15:15:36 GMT
etag: "0a976c266faeb5ef79e35d5f34f0f4c1"
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/2 200 OK
x-guploader-uploadid: ABPtcPq3b4e-glyp7bNhiLKPU2BgVbC0bvkVhiI2uBsr4r6FBi-Aa-0GviWR9ynA_910GQNwiwx-Euniqg
x-goog-generation: 1712675736658551
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 209
content-encoding: gzip
content-language: en
x-goog-hash: crc32c=usruUQ==, md5=BXwpaOwCZtEpPWNsoT37Ow==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 209
access-control-allow-origin: *
access-control-expose-headers: *
server: UploadServer
date: Fri, 10 May 2024 12:23:06 GMT
expires: Fri, 10 May 2024 12:53:06 GMT
cache-control: public, max-age=1800,no-transform
age: 184
last-modified: Tue, 09 Apr 2024 15:15:36 GMT
etag: "057c2968ec0266d1293d636ca13dfb3b"
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/2 200 OK
cache-control: max-age=3600
content-encoding: br
content-type: text/javascript; charset=utf-8
etag: "f8f605cbe153f6eecd30ecfc8c38d3e503341f939c85635e73d1f93839b12ed6-br"
last-modified: Fri, 02 Feb 2024 18:40:31 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
accept-ranges: bytes
date: Fri, 10 May 2024 12:26:10 GMT
x-served-by: cache-hel1410025-HEL
x-cache: MISS
x-cache-hits: 0
x-timer: S1715343970.787557,VS0,VE490
vary: x-fh-requested-host, accept-encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 353255
X-Firefox-Spdy: h2

HTTP/1.1 200 OK
x-amz-id-2: OXa7yMlKZDf1GQcsQ4+LVBlIN4qoWMXUois6+ZJD1pMLJpl98k4D5pmMj9QfHV4/nXuxp+GSKGY=
x-amz-request-id: 5AAFJ6WK6W2S0WG8
Date: Fri, 10 May 2024 12:26:11 GMT
Last-Modified: Wed, 10 Oct 2018 16:20:45 GMT
ETag: "289d6d9eb9ca99a01131505868ee5e2d"
Accept-Ranges: bytes
Content-Type: image/png
Server: AmazonS3
Content-Length: 7660

HTTP/3 200 OK
x-guploader-uploadid: ABPtcPp_gl9aR19-zYfX6tFcsgHJHh0DKiM5V9xhHkiGbLa--j1tXssvWteZtjVpqwb83PRRurc
x-goog-generation: 1712675736622932
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 43891
content-encoding: gzip
content-language: en
x-goog-hash: crc32c=JreHKw==, md5=K9r4gbIFsYle0Yi2Jk91mw==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 43891
access-control-allow-origin: *
access-control-expose-headers: *
server: UploadServer
date: Fri, 10 May 2024 12:13:53 GMT
expires: Fri, 10 May 2024 12:43:53 GMT
cache-control: public, max-age=1800,no-transform
age: 737
last-modified: Tue, 09 Apr 2024 15:15:36 GMT
etag: "2bdaf881b205b1895ed188b6264f759b"
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 204445
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 06 May 2024 16:12:34 GMT
expires: Tue, 06 May 2025 16:12:34 GMT
cache-control: public, max-age=31536000
last-modified: Sun, 05 May 2024 20:00:16 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 332016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 12:26:11 GMT
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Type: image/png
Content-Length: 6278
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Fri, 22 Mar 2024 10:47:09 GMT
X-Permitted-Cross-Domain-Policies: master-only
X-Frame-Options: DENY, SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff, nosniff
Access-Control-Allow-Methods: POST, GET, DELETE, PUT
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive

HTTP/2 200 OK
x-guploader-uploadid: ABPtcPpRdchGV6FrewsRuNMxLl_FXFz7v7xqIFcNZnkGFMLZaZ-l3cosv1DIeICVxKuooVW5Blo
x-goog-generation: 1699715039510755
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 81
x-goog-hash: crc32c=RCQxPg==, md5=4qi/VZBiHGUgePaQCHxHow==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 81
server: UploadServer
date: Fri, 10 May 2024 12:08:45 GMT
age: 1046
last-modified: Sat, 11 Nov 2023 15:03:59 GMT
etag: "e2a8bf5590621c652078f690087c47a3"
content-type: image/png
cache-control: public,max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/1.1 101 Switching Protocols
Date: Fri, 10 May 2024 12:26:11 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: hTLJ0ApDZhr+vow2s0IfbtsUkSQ=
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 24617
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 06 May 2024 19:34:32 GMT
expires: Tue, 06 May 2025 19:34:32 GMT
cache-control: public, max-age=31536000
last-modified: Sun, 05 May 2024 20:00:16 GMT
content-type: text/css
vary: Accept-Encoding
age: 319899
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 204445
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 06 May 2024 16:12:34 GMT
expires: Tue, 06 May 2025 16:12:34 GMT
cache-control: public, max-age=31536000
last-modified: Sun, 05 May 2024 20:00:16 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 332017
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15344
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 05 May 2024 18:37:19 GMT
expires: Mon, 05 May 2025 18:37:19 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
content-type: font/woff2
age: 409732
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/3 200 OK
content-type: text/javascript; charset=utf-8
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Fri, 10 May 2024 12:26:11 GMT
date: Fri, 10 May 2024 12:26:11 GMT
cache-control: private, max-age=300
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: br
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-length: 7438
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 09 May 2024 15:13:02 GMT
expires: Fri, 09 May 2025 15:13:02 GMT
cache-control: public, max-age=31536000
age: 76389
last-modified: Mon, 29 Apr 2024 11:30:00 GMT
content-type: text/javascript
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 204445
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 06 May 2024 16:12:34 GMT
expires: Tue, 06 May 2025 16:12:34 GMT
cache-control: public, max-age=31536000
last-modified: Sun, 05 May 2024 20:00:16 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 332017
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/3 200 OK
date: Fri, 10 May 2024 12:26:11 GMT
content-type: application/json
content-length: 487
access-control-allow-headers: Origin, Content-Type, Accept, Authorization
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://docs.sardine.ai
set-cookie: _immortal|deviceToken=eyJhbGciOiJkaXIiLCJjdHkiOiJKV1QiLCJlbmMiOiJBMTI4R0NNIiwidHlwIjoiSldUIn0..4o34F2xS-1QNyom-._2pCBBHKJqef4fykOd98smNtjl6Oo53rai43zLB7a1DIU-JoQAu2rK4uZWv3qNB57Rdlqz8Hl-MyNawiME875bm1Fp-_34rLpJX1XGxBUHEKMevepHzhH3zMJPU_y1pJArzkDr2PHkvAQgDCTNCvClAV0pMzOb52LCoNaMe7eb-vt80lapSWPHVtXMyOjRejShdaxAFBFeB7oZMLlFfP33Dsjl4NMXcB8Gp08p5409zIStQ7l6j38aLqmzLuFvqNPtKvUqW7KjxVcHvpsBeJT-QcMpfMbCI.fs0EsomT92eIOoorzJ5KRw; Path=/; Expires=Sat, 10 May 2025 12:26:11 GMT; Secure; SameSite=None
x-request-id: 8b2acdfc5bbe41ab92212f5ac981ef07
x-version-id: d5a438d
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/1.1 200 
Date: Fri, 10 May 2024 12:26:11 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=BCm59ViTL4rq3MqiIQrlNm2TwaabSVZ5UnBc3zBJuvM_BbkYe_dC5i9Q~UFEhYoQhT7Vz7xAwuYU0946IuCZX29WsI2e3iieL0JsutG5pieWegXfbqc7~FiJhPdx0AYN; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Access-Control-Allow-Origin: https://spafinder-partner.blackhawknetwork.com
Access-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE
Vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
Allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
Content-Length: 0
Access-Control-Allow-Headers: Access-Control-Allow-Headers, Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, requestId, unique-id, merchantId, tenantId, certificateId, role, clientConfigId, *
Access-Control-Expose-Headers: *, *
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 24617
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 06 May 2024 19:34:32 GMT
expires: Tue, 06 May 2025 19:34:32 GMT
cache-control: public, max-age=31536000
last-modified: Sun, 05 May 2024 20:00:16 GMT
content-type: text/css
vary: Accept-Encoding
age: 319900
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 204445
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 06 May 2024 16:12:34 GMT
expires: Tue, 06 May 2025 16:12:34 GMT
cache-control: public, max-age=31536000
last-modified: Sun, 05 May 2024 20:00:16 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 332018
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/1.1 200 
Date: Fri, 10 May 2024 12:26:11 GMT
Server: Apache
X-DataDome: protected
Accept-CH: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory
Set-Cookie: datadome=oD~cRnaha8JGtpC118kp4h8Kh68RStGPNrcCaH08zySK~7S3NOeucDjCIrmzJ3BtA8xbkXaP2axCIVfBgzsbsXB171PP~hJ6qvSJ0uNysnV3JhuDOaHEA~LvBOCoxo_y; Max-Age=31536000; Domain=.blackhawknetwork.com; Path=/; Secure; SameSite=Lax
Access-Control-Allow-Origin: https://spafinder-partner.blackhawknetwork.com
Access-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE
vary: accept-encoding
Content-Encoding: gzip
Content-Type: application/json
Access-Control-Allow-Headers: Access-Control-Allow-Headers, Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, requestId, unique-id, merchantId, tenantId, certificateId, role, clientConfigId, *
Access-Control-Expose-Headers: *, *
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked

HTTP/3 200 OK
date: Fri, 10 May 2024 12:26:33 GMT
content-type: application/json
content-length: 3
access-control-allow-headers: Origin, Content-Type, Accept, Authorization
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://docs.sardine.ai
x-request-id: 4e0cbe80215113270455fe141a0f021c
x-version-id: d5a438d
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/3 200 OK
content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 10 May 2024 12:26:11 GMT
content-security-policy: script-src 'nonce-8grvcJvrgVVY_APzQnCuWA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/3 200 OK
accept-ranges: bytes
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 2228
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 09 May 2024 02:54:07 GMT
expires: Thu, 16 May 2024 02:54:07 GMT
cache-control: public, max-age=604800
age: 120724
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
date: Fri, 10 May 2024 12:26:07 GMT
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: cx_pTJWQ5acyBduVwRx_UHkQHosaYWwhp6PC3q7Y4Avd1f9vJV5kOQ==
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: *
X-Firefox-Spdy: h2

HTTP/2 200 OK
content-type: text/javascript
last-modified: Thu, 2 May 2024 01:55:11 GMT
pragma: public
content-encoding: gzip
date: Fri, 10 May 2024 11:33:06 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: eCk7IXKL8OmKBcYOBcUwiZ5T1PFIipLO27dfdk9LHsFln4ErNLTH4Q==
age: 3183
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
access-control-allow-origin: *
access-control-expose-headers: *
X-Firefox-Spdy: h2

HTTP/2 200 OK
content-type: font/ttf
date: Fri, 10 May 2024 12:07:26 GMT
pragma: public
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: FlDTPqD-jwx4IFBY944wdlQjMEciCxmNjcpLMYFPaiPl0p0e080tiA==
age: 1123
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
access-control-allow-origin: *
access-control-expose-headers: *
X-Firefox-Spdy: h2

HTTP/1.1 101 Switching Protocols
Date: Fri, 10 May 2024 12:26:11 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: hTLJ0ApDZhr+vow2s0IfbtsUkSQ=
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/2 200 OK
content-type: font/ttf
date: Fri, 10 May 2024 12:20:56 GMT
pragma: public
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: D6b6uvC-4xqkHIK7F0icb2gZTdOJKwKUikae07TSm6gtDxE3s62YLQ==
age: 313
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=2592000
access-control-allow-origin: *
access-control-expose-headers: *
X-Firefox-Spdy: h2

HTTP/2 200 OK
cache-control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
content-type: image/png
expires: Thu, 01 Jan 1970 00:00:00 UTC
pragma: no-cache
x-accel-expires: 0
x-request-id: bf046366-9571-4098-a1cd-402da6f8751b
x-version-id: 5bea65f
date: Fri, 10 May 2024 12:26:11 GMT
X-Firefox-Spdy: h2

HTTP/2 200 OK
x-guploader-uploadid: ABPtcPq3b4e-glyp7bNhiLKPU2BgVbC0bvkVhiI2uBsr4r6FBi-Aa-0GviWR9ynA_910GQNwiwx-Euniqg
x-goog-generation: 1712675736658551
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 209
content-encoding: gzip
content-language: en
x-goog-hash: crc32c=usruUQ==, md5=BXwpaOwCZtEpPWNsoT37Ow==
x-goog-storage-class: STANDARD
accept-ranges: bytes
content-length: 209
access-control-allow-origin: *
access-control-expose-headers: *
server: UploadServer
date: Fri, 10 May 2024 12:23:06 GMT
expires: Fri, 10 May 2024 12:53:06 GMT
cache-control: public, max-age=1800,no-transform
age: 184
last-modified: Tue, 09 Apr 2024 15:15:36 GMT
etag: "057c2968ec0266d1293d636ca13dfb3b"
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
expires: Fri, 10 May 2024 12:26:10 GMT
date: Fri, 10 May 2024 12:26:10 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2