+ )}
+
+ {/* SECURITY: allow-same-origin is required so SpiceBook can access its
+ own storage/cookies. Safe because the iframe src is a different origin.
+ The parent MUST validate origin on any future postMessage listener.
+ NOTE: iframe onError does NOT fire for HTTP 4xx/5xx responses —
+ the 8s timeout is the primary error detection mechanism. A postMessage
+ handshake with SpiceBook would provide reliable HTTP error detection. */}
+