added gemfile
enable cors
add after_action in embed controller
add xameorigin policy to config/application.rb