set x-frame options to allow-all