Seems crazy that sites need to individually opt in to anti-Clickjacking with CSP, instead of modern browsers disabling it by default. In other cases, the defau

Seems crazy that sites need to individually opt in to anti-Clickjacking with CSP, instead of modern browsers disabling it by default. In other cases, the default is to not let a page mix origins: http://en.wikipedia.org/wiki/Same-origin_policy#Cross-Origin_Resource_Sharing http://en.wikipedia.org/wiki/Same-origin_policy#Cross-Origin...