Header set Content-Security-Policy "frame-ancestors 'self';"