Cross-Origin-Opener-Policy: same-origin-allow-popups