This iframe should not be blocked by Content-Security-Policy: