nginx config: fix the frame-options exclusion so its not fakeable by just including the embed/chat string somewhere