diff --git a/services/backend/hotpocket_backend/apps/ui/templates/ui/saves/partials/embed.html b/services/backend/hotpocket_backend/apps/ui/templates/ui/saves/partials/embed.html
index 9f8b46a..55577f8 100644
--- a/services/backend/hotpocket_backend/apps/ui/templates/ui/saves/partials/embed.html
+++ b/services/backend/hotpocket_backend/apps/ui/templates/ui/saves/partials/embed.html
@@ -3,11 +3,13 @@
 {% if save.is_youtube_video %}
 <div class="mb-0 d-flex justify-content-center">
   <iframe
-    allow="accelerometer; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
+    allow="accelerometer *; clipboard-write *; encrypted-media *; gyroscope *; picture-in-picture *; web-share *;"
     allowfullscreen
     class="ui-youtube-iframe"
     frameborder="0"
     height="200"
+    referrerpolicy="strict-origin"
+    scrolling="no"
     src="{{ save|render_youtube_embed_url }}"
     title="YouTube video player"
     width="320"
diff --git a/services/backend/tasks.py b/services/backend/tasks.py
index cc33876..885f8fb 100644
--- a/services/backend/tasks.py
+++ b/services/backend/tasks.py
@@ -103,7 +103,7 @@ def ci(ctx: Context):
 @task
 def setup(ctx: Context):
     ctx.run('python manage.py migrate')
-    ctx.run('python manage.py create_initial_account hotpocket hotpocketm4st3r')
+    ctx.run('python manage.py create_initial_account -u hotpocket -p hotpocketm4st3r')
 
     if WORKSPACE_MODE == WorkspaceMode.METAL:
         ctx.run('mkdir -p run/uploads')