Pages are allowed to be embedded as iframes

Content-Security-Policy: frame-ancestors self https://xxxx

Allow iframes to be embedded by adding this