On our IIS website, I need to allow only one specific PDF file to be opened in an iframe by any other site. Currently the content-security-policy in the web.config is this:<