SAMEORIGIN instead of DENY

Allows for iframe testing *inside* jsbin