Using srcdoc, especially with multiple nested iframes, seems to be problematic when using `self` in CSP policies.