[server] stop blocking cross-origin iframes