Is the allow thing like this really true? I was under the impression that everything is disallowed by default, and you specifically have to allow it to work, hence the default embeds from YouTube and others having it on there.