Another XFO/CSP loophole: we now over-use "https:" as a CSP frame-ancestor.  But
X-FRAME-OPTION cannot express that (or wildcards), so we need to omit the header
in those cases.

@rev goliver@
@bug W-2423609@
Merge branch 'fabbott/master-pending/xfo-wildcards'