enable cross-origin resource sharing and disable x-frame-options

tested, working.