Changed x-frames header to sameorigin to allow upload frame to show