Permit iframing for the resume module on canvas with a security rationale

This is harmless for our specific case and enables auto login from a Canvas iframe, making the resume module a bit more user friendly in the case of them logging into canvas via SSO but not propagating the cookie to BZ.