<IfModule mod_headers.c>
  # Allow the static relay page to be embedded without weakening protection
  # for other files. Drupal's response headers do not apply to static files.
  <Files "relay.html">
    # Apache keeps default and "always" response headers in separate tables.
    Header onsuccess unset X-Frame-Options
    Header always unset X-Frame-Options
    # Remove only frame-ancestors; preserve the rest of each policy.
    Header onsuccess edit* Content-Security-Policy "(?i)(^|[;,][[:space:]]*)frame-ancestors[[:space:]]+[^;,]*([;,]|$)" "$1$2"
    Header always edit* Content-Security-Policy "(?i)(^|[;,][[:space:]]*)frame-ancestors[[:space:]]+[^;,]*([;,]|$)" "$1$2"
    Header onsuccess edit* Content-Security-Policy-Report-Only "(?i)(^|[;,][[:space:]]*)frame-ancestors[[:space:]]+[^;,]*([;,]|$)" "$1$2"
    Header always edit* Content-Security-Policy-Report-Only "(?i)(^|[;,][[:space:]]*)frame-ancestors[[:space:]]+[^;,]*([;,]|$)" "$1$2"
  </Files>
</IfModule>
