remove X-Frame - for json
block POST