Dealing with anal sites Content-Security-Policy

Deals with sites setting Content-Security-Policy: frame-src 'self' to
be a whitelist only (EG: GitHub).

Fallsback to pressing the page in full window.
Have to because the trick to add an event to detect if the iframe
actually loaded or got clocked “disconnects” from the user’s original
click, and leads to attempts to loading PT in a popup instead being
blocked by popup blockers…
Adding id and initial action on close button