Allow cross-domain iframe loading for all origins

Using the xframe_options_exempt decorator didn't seem to work when
using Django's Site model or the url templatetag.
Add id to widget's iframe and fix src URL