CSP frame-ancestors 'none' is set but X-Frame-Options DENY is not.