[Bug] Use same origin as header default (#900)

app/Http/Middleware/FrameAllowOptions.php

@@ -17,9 +17,7 @@ class FrameAllowOptions
     {
         $response = $next($request);
 
-        if (! blank(config('speedtest.allow_embeds'))) {
-            $response->header('X-Frame-Options', 'ALLOW-FROM '.config('speedtest.allow_embeds'));
-        }
+        $response->header('X-Frame-Options', 'ALLOW-FROM '.config('speedtest.allow_embeds'));
 
         return $response;
     }

config/speedtest.php

@@ -27,5 +27,5 @@ return [
     /**
      * Security
      */
-    'allow_embeds' => env('ALLOW_EMBEDS', null),
+    'allow_embeds' => env('ALLOW_EMBEDS', 'SAMEORIGIN'),
 ];