Consider forcing on allowframembedding on just the pages which need it

[brendanheywood]

Mostly consider the security downsides of doing this Alternative add a runtime check if it isn't set