added allowall to xframeoptions