Adding allow-same-origin for iframe previews in case of logins