I was thinking along those lines: this api (content security policy) didn't work with older browsers, because they didn't exist. An older browser wouldn't have

I was thinking along those lines: this api (content security policy) didn't work with older browsers, because they didn't exist. An older browser wouldn't have blocked this iframe. And by looking up, it would be indeed very old. So yeah my rant didn't apply to this particular instance.