tweaks to content-security-policy to ensure that some safe activity is still allowed, like using the target attribute in a link inside a frame (h/t Łukasz Pilorz)