Added: Protective header removal to allow iframes

[daanggc]

Removes the following header:

• X-Frame-Options
• Content-Security-Policy

This allows sources that have these headers set to be displayed in an iframe.

[joshdick]

Not sure how I feel about these changes, since they remove the security restrictions intended by these headers. This may improve proxy compatibility, but would be less secure for general use.

[BelleNottelling]

Could be an optional toggle?

[daanggc]

A toggle would be a good option, in my case I just needed this for two weeks, after that, I got my project domain added to those security headers.

A toggle that is default set to disable would make sure the user that provides the proxy is aware of what he/she is doing.