private

  def allow_iframe
    response.headers.except! 'X-Frame-Options'