added X-Frame-Options to production config to enable embed in other sites