Restrict frame-ancestors to 'self' in CSP
Clean up logs, enable debug log for header except
One unified CSP report URI