title: Why xframe_options_exempt doesn't work for my Django view?
body: <p>I want my view page to be loaded via iframe from another domain, so following Django doc, I add the decorator <code>@xframe_options_exempt</code> to my view. But when it is loaded in iframe, Chrome still reports: </p>
  
  <blockquote>
    <p>Uncaught SecurityError: Blocked a frame with origin "<a href="http://www.aaa.com" rel="nofollow">http://www.aaa.com</a>" from accessing a frame with origin "<a href="http://bbb.com" rel="nofollow">http://bbb.com</a>".</p>
  </blockquote>
  
  <p>And from DevTools Network tab, I see the response doesn't include 'X-Frame-options' header.</p>
  
  <p>What is happening here? </p>