Remove obsolete prevent_framing_and_css.

Framing is now blocked by default.
Constrain betamode routes to non-sr URL contexts.