removed x-frame to allow iframe embedding