Seems crazy that sites need to individually opt in to anti-Clickjacking with CSP, instead of modern browsers disabling it by default.

In other cases, the default is to not let a page mix origins: http://en.wikipedia.org/wiki/Same-origin_policy#Cross-Origin...