changed default headers to allow iframes