We have used the same code for about 2 years now, and now it no longer allows the picker to display. I reviewed Google Picker API Invalid origin but seem unable to actually set the origin value. The picker initialization is below.

picker = new google.picker.PickerBuilder()
.addView(new google.picker.DocsUploadView().setIncludeFolders(true))
.setOAuthToken(token)
.setDeveloperKey(developerKey)
.setCallback(pickerCallback)
.setOrigin('https://docs.google.com')
.build();

The full error is

[Report Only] Refused to frame 'https://docs.google.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors https://docs.google.com".
3760914899-picker_modularized_opc.js:1112 Uncaught Error: Incorrect origin value. Please set it to - (window.location.protocol + '//' + window.location.host) of the top-most page
    at new KJ (3760914899-picker_modularized_opc.js:1112)
    at 3760914899-picker_modularized_opc.js:1115
    at HTMLDocument.<anonymous> (picker:61)
rpc.js?c=1&container=onepick:127 Invalid rpc message origin.  vs https://host45.mydomain.com

The last line suggests the origin is an empty string or undefined.