set x-frame-options to allowall for production env
serve static files with rack in production