change security settings to allow embedding with no domain restrictions