title: "Content-Security-Policy", "frame-ancestors 'none'" not working
body: <p>I have the following java filter to had the CSP to each response for my Angular app.</p>
  
  <pre><code>public class FrameOptionsFilter implements Filter {
  
  @Override
  public void doFilter(ServletRequest request, ServletResponse servletResponse, final FilterChain filterChain)
          throws IOException, ServletException {
      HttpServletResponse response = (HttpServletResponse) servletResponse;
      response.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
      ...
  </code></pre>
  
  <p>I use this snippet to test my app:</p>
  
  <pre><code>    &lt;html&gt;
       &lt;head&gt;
       &lt;title&gt;Clickjacking Test&lt;/title&gt;
        &lt;/head&gt;
         &lt;body&gt;
          &lt;p&gt;Website is vulnerable to clickjacking!&lt;/p&gt;
          &lt;iframe src="http://localhost:4200/myapp/" width="600" height="600"&gt;&lt;/iframe&gt;
          &lt;/body&gt;
      &lt;/html&gt;
  </code></pre>
  
  <p>The login screen load and once I log in I can still access the app!</p>
  
  <p>the response from the server:</p>
  
  <pre><code>Request URL: https://localhost:4200/myapp/login/jwt
  HTTP/1.1 200 OK
  X-Powered-By: Servlet/3.1
  Content-Security-Policy: frame-ancestors 'none'
  </code></pre>
  
  <p>What am I missing?</p>