set iFrame headers to allow all and render user without layout