Cleanup after investigation

lib/runtimeSettings.js

@@ -325,15 +325,11 @@ module.exports = {
         ui: true
     },
     httpAdminMiddleware: function(req,res,next) {
-        res.set("Content-Security-Policy", "frame-ancestors 'self' *.flowforge.cloud *.flowfuse:* *.flowforge:*");
-        res.set("X-Frame-Options", "allow-from *.flowforge.cloud *.flowfuse:* *.flowforge:*");
+        res.set("Content-Security-Policy", "frame-ancestors 'self' ${settings.forgeURL}");
         next()
     }
 }
 `
-    // todo ^^ the httpAdminMiddleware runtime config allows the editor to be embedded in an iframe on the forge site
-    //  both headers are required for legacy browsers and best practice
-    //  pf course, they should not be hardcoded, a better solution would be to allow the ff app to set these headers
     return settingsTemplate
 }
 

lib/theme/common/forge-common.js

@@ -26,8 +26,7 @@
                 navigateTo(url)
             })
     }
-    // todo remove later
-    document.cookie = 'regularCookie=dontMindMe;'
+
     function changeFavicon (src) {
         const link = document.createElement('link')
         const oldLink = $('link[href="favicon.ico"]')[0] || $('#dynamic-favicon"]')[0]