Answering my own posting: This is the error:
Refused to load plugin data from 'https://www.acme.com/page.pdf' because it violates the following Content Security Policy directive: "object-src 'none'".
Removed that from the csp config and now it works.