Content Security Policy violation

Has anyone ever come across this:

Refused to display 'https://us-east-...' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors https://www.[url].com".

The embed URL returns fine, and works in its own browser.  I have added headers to my nginx.conf file like: add_header Content-Security-Policy "frame-ancestors https:"; 