X-Frame-Options SAME-ORIGIN is set but there is no CSP frame-ancestors 'self' entry.