• Presently only checks if allow === "monetization", which breaks if other directives are present.
• Should also handle monetization directive's allowlist correctly, specially the "<origin>" type.

Spec: https://webmonetization.org/specification/#permissions-policy
MDN: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy#iframes