X-Frame-Options with values other than deny and sameorigin has limited browser support, and only supports a single domain: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Replace it with the much more flexible Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy which deprecates X-Frame-Options https://www.w3.org/TR/CSP2/#frame-ancestors-and-frame-options

Django CSP module: https://github.com/mozilla/django-csp
Original requirement: https://forum.image.sc/t/cors-white-listing/29457/7