Nick Joliat

(i found [this old thread](https://github.com/mitodl/sga-lti/issues/56) which seems like it's about the same issue; not sure if that's the case and/or whether anything has changed?)

@pdpinch I'd imagine this has already been considered, but based on [this page](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) it does indeed seem like the X-Frame-Options field isn't supposed to be 'ALLOW', and maybe should be...