Update app.rb

disable iframe protection