Drops X-Frame-Options and Content-Security-Policy HTTP response headers, allowing all pages to be iframed.