trying to allow a iframe by setting the x-frame-options