[sameorigin.sub.html]
  [`XFO: SAMEORIGIN` blocks cross-origin framing.]
    expected: FAIL