Try allow-from header (limited browser support)

PyRIGS/decorators.py

@@ -10,7 +10,7 @@ def allow_embed():
     def headers_wrapper(fun):
         def wrapped_function(*args, **kwargs):
             response = fun(*args, **kwargs)
-            response['X-Frame-Options'] = "ALLOW"
+            response['X-Frame-Options'] = "ALLOW-FROM https://forum.nottinghamtec.co.uk/"
             return response
         return wrapped_function
     return headers_wrapper