yuancheng
0c4bed5b6f
mmdvmhost/lh.php (and admin/mmdvmhost/lh.php) require_once this file and call setEmbeddableSecurityHeaders(), but the file was never committed to this repo (confirmed absent across main/dev/development history), causing a fatal "failed opening required" 500 on the Last Heard panel. Restores both setSecurityHeaders() (full page: adds X-Frame-Options + CSP frame-ancestors) and setEmbeddableSecurityHeaders() (AJAX partial variant, omits the framing directives since it's loaded into the parent via $.load(), not an iframe), matching the behavior described in the comments already present in lh.php and functions.php.
