Add access control origin
Add x-frame-options to allowall