You are right. I tried a few configs yesterday and couldn’t figure anything out, but with fresh eyes this morning I was able to get it to work!
For anyone that has this issue, I just added this line to the bottom of my MAMP httpd.conf file.
Header always append Content-Security-Policy "frame-ancestors www.twitch.tv dashboard.twitch.tv supervisor.ext-twitch.tv;"
The Content-Security-Policy header is fairly new, but seems to be compatible with all current browsers.