Only allow iframe embedding on same origin.

This sets the iframe security policy by default to only allow same origin embedding of the notebook. This can be overridden by changing `headers['X-Frame-Options']`.