removed clickjacking protection because of the iframe embedding