With clickjacking disabled:
With clickjacking enabled: