django was adding X-Frame-Options: SAMEORIGIN. but we need to embed this page. disabling this feature for /iframe/ view