This isn't a bug you can configure away — it's a browser security policy. Here's the fix that actually works.