Thanks for testing. I was only testing by loading the iframe contents directly, but it looks like the entire chain of embedding pages will need have their headers updated.
I’ve identified some breaking issues with these headers for existing games though, so I’ve decided to turn off these headers for now.
It looks like we’ll probably have run two separate CDN configurations at the same time to ensure maximum compatibility. Our backend storage does not let use set headers per object, so these headers will have to be globally injected at the CDN. So I’ll likely have a Legacy mode and a New mode for when you choose how your HTML5 games are delivered.