fix: apply iframe CSP fix before URL rewrite to prevent frame-ancestors 'none'

The writeHead wrapper that strips X-Frame-Options and fixes
frame-ancestors was placed after the URL rewrite code. When
req.url was rewritten and origEmit was called early, the iframe
fix was never applied, causing 'frame-ancestors none' to block
HF iframe embedding. Moved the fix to run immediately after the
port check, before any routing logic.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/token-redirect.cjs

@@ -160,6 +160,21 @@ http.Server.prototype.emit = function (event, ...args) {
       return origEmit.apply(this, [event, ...args]);
     }
 
+    // Fix iframe embedding — must be applied BEFORE any early returns
+    const origWriteHead = res.writeHead;
+    res.writeHead = function (statusCode, ...whArgs) {
+      if (res.getHeader) {
+        res.removeHeader('x-frame-options');
+        const csp = res.getHeader('content-security-policy');
+        if (csp && typeof csp === 'string') {
+          res.setHeader('content-security-policy',
+            csp.replace(/frame-ancestors\s+'none'/i,
+              "frame-ancestors 'self' https://huggingface.co https://*.hf.space"));
+        }
+      }
+      return origWriteHead.apply(this, [statusCode, ...whArgs]);
+    };
+
     const parsed = url.parse(req.url, true);
     const pathname = parsed.pathname;
 
@@ -225,25 +240,6 @@ http.Server.prototype.emit = function (event, ...args) {
     }
   }
 
-  // Fix iframe embedding on all responses
-  if (event === 'request') {
-    const [req, res] = args;
-    const origWriteHead = res.writeHead;
-    res.writeHead = function (statusCode, ...whArgs) {
-      // Remove X-Frame-Options to allow HF iframe embedding
-      if (res.getHeader) {
-        res.removeHeader('x-frame-options');
-        const csp = res.getHeader('content-security-policy');
-        if (csp && typeof csp === 'string') {
-          res.setHeader('content-security-policy',
-            csp.replace(/frame-ancestors\s+'none'/i,
-              "frame-ancestors 'self' https://huggingface.co https://*.hf.space"));
-        }
-      }
-      return origWriteHead.apply(this, [statusCode, ...whArgs]);
-    };
-  }
-
   return origEmit.apply(this, [event, ...args]);
 };