allow-forms
allow-same-origin
allow-scripts
allow-top-navigation