Parent page and embed page must be secure.