FAIL (cross-domain frame spoofing protection is overbearing)