X-Frame-Options, Content-Security-Policy