How do I allow iframe embeds to a particular domain? I see that Drupal now automatically adds the 'X-Frame-Options: SAMEORIGIN' header. However, the client would like to give explicit permission to allow a iframe embed to another site. 

How do I allow iframe embeds to a particular domain?
https://www.drupal.org/project/seckit

you can set security level and also set exceptions