Be less permissive in frame options (only allow FB canvas to embed).