hack for X-Frame-Options header allowing