@browsermator: So there is no possible way to enable that. You mean when I do allow-scripts it is dangerous anyways? I mean click-jacking should only concern the iframe code and not the rest of the app right? does csrf work when it can't read the site cookies etc.? how would that work? I am not very well-read on that subject.