#cors

Anti-framing rule put in a meta tag, where browsers won't honor it

The marketing site's framing protection lived in a meta tag the browser ignores for that rule, so it moved to real headers, and the API's new origin allowlist lets requests with no Origin through on purpose, for reasons written down next to the code.