FAIL (cross-domain frame spoofing protection is overbearing and ignores document.domain)