allow iframe requests

app/controllers/application_controller.rb

@@ -5,7 +5,7 @@ class ApplicationController < ActionController::Base
   MEMBER_ACTIONS = [:destroy, :edit, :show, :update]
 
   after_action :verify_authorized, except: [:help, :welcome]
-  before_action :set_locale
+  before_action :set_locale, :allow_iframe_requests
   protect_from_forgery(with: :exception)
   rescue_from Pundit::NotAuthorizedError, with: :render_not_authorized
 
@@ -29,4 +29,8 @@ class ApplicationController < ActionController::Base
 
   def welcome
   end
+
+  def allow_iframe_requests
+    response.headers.delete('X-Frame-Options')
+  end
 end