[v6.2] Fix CSP/X-Frame-Options headers

[simonhammes]

• ALLOWALL is not an allowed value for the X-Frame-Options header
  • Source: https://stackoverflow.com/questions/44436659/change-the-x-frame-options-to-allow-all-domains#comment103878548_50840793

[simonhammes]

This completely removes the CSP header for all universal apps.

What was the initial purpose of this? Allow embedding apps and forms within other pages? The commit message of dbe7f6c suggests this.

We could do this through a frame-ancestors directive

[simonhammes]

Completely disabling the CSP for a bunch of path prefixes seems like the wrong approach for this

We could do this through a frame-ancestors directive

However, this should probaly still be path-scoped to prevent unnecessary risk of clickjacking attacks.

---

Maybe strict SameSite settings for auth cookies are "enough" to defend against clickjacking attacks:

As an additional partial mitigation, sites should set the SameSite cookie attribute for session cookies to Lax or Strict. Requests from embedded contexts such as <iframe> elements that are not same-site with the top-level document will not include these cookies, and the server will therefore not treat the request as coming from a logged-in user.