This option is now obsolete in the standards and browsers are complaining. This needs to move to be a CSP header but this is hard to do from outside the app (since it has to be 'merged' with the app's existing CSP). fixes #596
This doesn't trigger a re-configure (since it's not a big deal)