Set CSP frame-ancestors 'self' for nbgrader handlers (#1915)

Co-authored-by: Nicolas Brichet <[email protected]>

Author: jeflem

nbgrader/server_extensions/formgrader/base.py

@@ -60,6 +60,10 @@ def api(self):
         api.log_level = level
         return api
 
+    def initialize(self):
+        super().initialize()
+        self.set_header("Content-Security-Policy", "frame-ancestors 'self'")
+
     def render(self, name, **ns):
         template = self.settings['nbgrader_jinja2_env'].get_template(name)
         return template.render(**ns)