separate code into header/ui with iframe to avoid XSS attacks on our sessions