@Test
void appendSecurityHeaders() {

    interceptor.contentSecurityPolicy = "default-src 'self';";
    when(response.contentType()).thenReturn(Optional.of(ContentType.TEXT_HTML));
    interceptor.appendSecurityHeaders(response);
    verify(response).header(eq("Strict-Transport-Security"), anyString());
    verify(response).header("Content-Security-Policy", interceptor.contentSecurityPolicy);
    verify(response).header(eq("X-XSS-Protection"), anyString());
    verify(response).header(eq("X-Content-Type-Options"), anyString());
    verify(response).header(eq("X-Frame-Options"), anyString());
}