Some details about embedding Twitch into browser extensions.
In Chromium-based browsers, we must specify parent parameter with localhost or any valid domain. The browser ignores frame-ancestors directive - this is exactly what we need.
In Firefox, we must intercept HTTP response and remove the entire Content-Security-Policy header (removing the directive is not enough).