Rack iframe for session-cookie management