Content-Security-Policy: frame-ancestors 'self' X-Frame-Options: SAMEORIGIN Steve Larsen: September 2011