Fix header issue with svg being used inside objects

object is a psuedo iframe and so require we send the X-Frame-Options header not as DENY