added x-frame options allow all to application.rb