fix self-service fallout from clickjacking fix, RT#39881