content_security_policyにframe-srcを追加