[server] stop blocking cross-origin iframes

Addresses part of #1635 

Setting this option allows people to embed visualizations and dashboard on other origins.

Failing example: http://run.plnkr.co/tkTnAI24fv9vtmqx/
![image](https://cloud.githubusercontent.com/assets/1329312/4696911/ea2785c2-581c-11e4-88d3-c0afbfe95e51.png)