Dropbox issuing CSP header based on browser.

scott@securityheaders:~/Per$ curl -A "Mozilla/5.0 (Windows NT 6.1; rv:27.3) Gecko/20130101 Firefox/27.3" -I https://www.dropbox.com/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 01 Feb 2016 18:09:04 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
set-cookie: locale=en; Domain=dropbox.com; expires=Sat, 30 Jan 2021 18:09:04 GMT; Path=/; secure
set-cookie: gvc=MjE1MDg1NzA3OTg0MjM5NDYyMzAwNDI4Mjk3NTA4MTgwMDA0OTI0; expires=Sat, 30 Jan 2021 18:09:04 GMT; httponly; Path=/; secure
set-cookie: __Host-js_csrf=HEIhi59qjkb4huRRVkcVj2fN; expires=Thu, 31 Jan 2019 18:09:04 GMT; Path=/; secure
set-cookie: t=HEIhi59qjkb4huRRVkcVj2fN; Domain=dropbox.com; expires=Thu, 31 Jan 2019 18:09:04 GMT; httponly; Path=/; secure
set-cookie: puc=; expires=Mon, 01 Feb 2016 18:09:04 GMT; httponly; Path=/; secure
x-dropbox-request-id: 11ec0d4ec7b22f10ce256aec1fde7c7b
pragma: no-cache
cache-control: no-cache
x-dropbox-http-protocol: None
x-frame-options: SAMEORIGIN
X-Server-Response-Time: 233
Strict-Transport-Security: max-age=15552000; includeSubDomains

scott@securityheaders:~/Per$ curl -A "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1" -I https://www.dropbox.com/
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 01 Feb 2016 18:09:13 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
x-xss-protection: 1; mode=block
content-security-policy: img-src https://* data: blob: ; connect-src https://* ws://127.0.0.1:*/ws ; media-src https://* ; object-src https://cf.dropboxstatic.com/static/ https://www.dropboxstatic.com 'self' https://flash.dropboxstatic.com https://swf.dropboxstatic.com https://dbxlocal.dropboxstatic.com ; default-src 'none' ; font-src https://* data: ; frame-src https://* carousel://* dbapi-6://* itms-apps://* itms-appss://* ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; script-src https://ajax.googleapis.com/ajax/libs/jquery/ 'unsafe-eval' 'self' https://cf.dropboxstatic.com/static/javascript/ https://www.dropboxstatic.com/static/javascript/ https://cf.dropboxstatic.com/static/api/ https://www.google.com/recaptcha/api/ 'nonce-zMSyke6U4jT5JRJroO3R' ;
x-content-type-options: nosniff
set-cookie: locale=en; Domain=dropbox.com; expires=Sat, 30 Jan 2021 18:09:13 GMT; Path=/; secure
set-cookie: gvc=NTMxNzY3MTc1Njc5NTIwOTE0NjIxMTUxNDk5ODExNjY2ODY3NDY%3D; expires=Sat, 30 Jan 2021 18:09:13 GMT; httponly; Path=/; secure
set-cookie: __Host-js_csrf=7F5ruunEHVhH-Mgq7sX2UJFZ; expires=Thu, 31 Jan 2019 18:09:13 GMT; Path=/; secure
set-cookie: t=7F5ruunEHVhH-Mgq7sX2UJFZ; Domain=dropbox.com; expires=Thu, 31 Jan 2019 18:09:13 GMT; httponly; Path=/; secure
set-cookie: puc=; expires=Mon, 01 Feb 2016 18:09:13 GMT; httponly; Path=/; secure
x-dropbox-request-id: 2f5c7a39097f3318bbeef30813ec7289
pragma: no-cache
cache-control: no-cache
x-dropbox-http-protocol: None
x-frame-options: SAMEORIGIN
X-Server-Response-Time: 273
Strict-Transport-Security: max-age=15552000; includeSubDomains