X-Frame-Options ALLOW-FROM is set but the mentioned domain is not in the CSP frame-ancestors definition.