This puzzled me a bit until I found http://stackoverflow.com/questions/18445782/how-to-override-x-frame-options-for-a-controller-or-action-in-rails-4. Could you add a comment above this line, linking to that article? (the missing bit of knowledge was that Rails by default sets too secure X-Frame-Options).