SEC-2656: Fix <frame-options> with whitelist strategy