added x-frame options: allow all