[deny.sub.html]
  [`XFO: DENY` blocks same-origin framing.]
    expected: FAIL

  [`XFO: DENY` blocks cross-origin framing.]
    expected: FAIL