CSP 1.1: Directive names are case insensitive.
CSP 1.1: Be clear about not supporting report-only inside <meta>.
CSP 1.1: Allow error pages for frame-ancestors violations.

User agents may prefer to provide users with a friendly error page when
dealing with frame-ancestors violations. Adding some normative text that
allows this use case (as long as the error page is cross-origin).