Use html_safe to the auth_url
Change X-Frame ALLOW value