add code to app controller to allow iframes