X-Frame-Options DENY is set but there is no CSP frame-ancestors 'none' entry.