is a good find.
That points to an apache configuration difference between our NASes!!

Looking now I see that under default-config/apache.conf there is the following

<IfModule headers_module>
Header always append X-Frame-Options SAMEORIGIN "env=!share-iframe"
Header always edit Set-Cookie ...