1890738: revert to default CSP options if directives are empty
1809020: prevent Origin check for localhosts
1893038: support Allow-From in X-Frame-Options