Match page response includes X-Frame-Options or frame-ancestors

Response-header hygiene: Content-Security-Policy and either X-Frame-Options or frame-ancestors directive on every match page.