Set a policy of allowing scripts on same domain

Chrome now has tighter rules via security auditorm this line needed to
allow x-frame script use