consent.js posts the consent form in the background, the server answers 204 with the cookie, and the script swaps in the embeds and the legal line from a fresh copy of the page. Embed hosts are in frame-src from the start, the content address still only after consent. Without JavaScript the form keeps working with a reload. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>