diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf
index 16a26872c..ea1c45516 100644
--- a/docs/example.nginx.conf
+++ b/docs/example.nginx.conf
@@ -23,15 +23,12 @@ server {
     set $main_domain "your-main-domain.com";
     set $sandbox_domain "your-sandbox-domain.com";
 
-    # By default CryptPad allows remote domains to embed CryptPad documents in iframes.
-    # This behaviour can be blocked by changing $allowed_origins from "*" to the
-    # sandbox domain, which must be permitted to load content from the main domain
-    # in order for CryptPad to work as expected.
-    #
-    # An example is given below which can be uncommented if you want to block
-    # remote sites from including content from your server
-    set $allowed_origins "*";
-    # set $allowed_origins "https://${sandbox_domain}";
+    # By default CryptPad forbids remote domains from embedding CryptPad documents in iframes.
+    # The sandbox domain must always be permitted in order for the platform to function.
+    # If you wish to enable remote embedding you may change the value below to "*"
+    # as per the commented value.
+    set $allowed_origins "https://${sandbox_domain}";
+    #set $allowed_origins "*";
 
     # CryptPad's dynamic content (websocket traffic and encrypted blobs)
     # can be served over separate domains. Using dedicated domains (or subdomains)
diff --git a/www/common/toolbar.js b/www/common/toolbar.js
index a827364e6..c1595cd2c 100644
--- a/www/common/toolbar.js
+++ b/www/common/toolbar.js
@@ -764,6 +764,10 @@ MessengerUI, Messages, Pages) {
             $input.val(inputVal);
             $input.show();
             $input.focus();
+            if (inputVal === $input.attr('placeholder')) {
+                // Placeholder is the default name, select text to make editing easier
+                $input.select();
+            }
             $pencilIcon.hide();
             $saveIcon.show();
         };