fix X-Frame-Options so site can be embeded from every origin