ops: Don't always set frameoptions in nginx

production/nginx/server-common.conf

@@ -8,8 +8,11 @@ add_header Onion-Location http://$onion.onion$request_uri;
 add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
 
 # generate frame configuration from origin header
-set $frameOptions "DENY";
-set $contentSecurityPolicy "frame-ancestors 'none'";
+if ($frameOptions = '')
+{
+	set $frameOptions "DENY";
+	set $contentSecurityPolicy "frame-ancestors 'none'";
+}
 
 # used for iframes on https://mempool.space/network
 if ($http_referer ~ ^https://mempool.space/)