Add object and iframe elements to the list of verboten elements, matching CSP header.