Better X-Frame-Options handling

Allow crossframe embedding on specific controller actions