title: Running into x-frame-options issues when running sample Azure AD B2C auth code
body: <p>I am trying to run Microsoft's sample code for implementing Azure AD B2C authentication. 
  The codebase can be found here:
  <a href="https://github.com/Azure-Samples/active-directory-b2c-javascript-msal-singlepageapp/blob/master/index.html" rel="nofollow noreferrer">https://github.com/Azure-Samples/active-directory-b2c-javascript-msal-singlepageapp/blob/master/index.html</a></p>
  
  <p>I modified the code so as shown in the following gist. The main change is that instead of using the Msal.UserAgentApplication object's loginPopup() method, I am using loginRedirect() (for the better user experience)
  <a href="https://gist.github.com/ttchuah/6718e268a235a3206968b36d748fd369" rel="nofollow noreferrer">https://gist.github.com/ttchuah/6718e268a235a3206968b36d748fd369</a></p>
  
  <p>Here is what happens when I run the code.</p>
  
  <ol>
  <li>I see the index.html page as expected.</li>
  <li>I click the login button, get redirected to the Microsoft login page, where I can see the option to do a social login via Google.</li>
  <li>I log in through Google and get redirected back to my index.html page. </li>
  </ol>
  
  <p>At this point, the "authCallback()" function fires. </p>
  
  <p>In Chrome, I get the following console error. Any ideas why?
  <strong>Refused to display '<a href="https://accounts.google.com/o/oauth2/auth?client_id=903295266285-78au30g3bsmt8q1phvfqqu65c58kp35i.apps.googleusercontent.com&amp;redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fte%2fdv0dop000devaad000.onmicrosoft.com%2foauth2%2fauthresp&amp;response_type=code&amp;scope=email+profile&amp;state=StateProperties%3deyJTSUQiOiJ4LW1zLWNwaW0tcmM6OGM1YTQwNDQtNGYyYi00ZTJmLTgyMmUtYjU2ZjRkMWU4ZWU2IiwiVElEIjoiMDBmZjUzOTctNjYxZC00NDY4LWFlODktNzlkOThlMmEwMzI0In0" rel="nofollow noreferrer">https://accounts.google.com/o/oauth2/auth?client_id=903295266285-78au30g3bsmt8q1phvfqqu65c58kp35i.apps.googleusercontent.com&amp;redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fte%2fdv0dop000devaad000.onmicrosoft.com%2foauth2%2fauthresp&amp;response_type=code&amp;scope=email+profile&amp;state=StateProperties%3deyJTSUQiOiJ4LW1zLWNwaW0tcmM6OGM1YTQwNDQtNGYyYi00ZTJmLTgyMmUtYjU2ZjRkMWU4ZWU2IiwiVElEIjoiMDBmZjUzOTctNjYxZC00NDY4LWFlODktNzlkOThlMmEwMzI0In0</a>' in a frame because it set 'X-Frame-Options' to 'sameorigin'.</strong></p>
  
  <p>The same error does <em>not</em> happen in FireFox or Safari. For those browsers, I am able to get an auth token back without issue.</p>