Changing to an open allow all to bypass the default SAMEORIGIN policy applied for X-Frame-Options
Updating http to https for the OpenSans font from Google