controller: Allow frame and remove CSRF protection