prevent X-frame denied urls from breaking the login process