title: Fix Rails oauth facebook x-frame-options sameorigin error
body: <p>I can't for the life of me get my Facebook canvas app to display.  Chrome console displays this error and nothing shows up inside the iframe - it's blank: </p>
  
  <p><code>Refused to display 'http://mysite.dev/' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.</code></p>
  
  <p>I'm using <em>Rails 4.0.0.rc1</em> and <em>omniauth-facebook 1.4.1</em>, following the <a href="http://railscasts.com/episodes/360">Railscast on Facebook Authentication</a> as a guide.  I didn't use any of the Javascript code since it was optional and ideally the app should only be accessed within Facebook.</p>
  
  <p><strong>routes.rb</strong></p>
  
  <pre><code>  match 'auth/:provider/callback', to: 'sessions#create', via: [:get, :post]
    match 'auth/failure', to: redirect('/'), via: [:get, :post]
    match 'signout', to: 'sessions#destroy', as: 'signout', via: [:get, :post]
  </code></pre>
  
  <p><strong>sessions_controller.rb</strong></p>
  
  <pre><code>class SessionsController &lt; ApplicationController
  
    def create
      user = User.from_omniauth(env["omniauth.auth"])
      session[:user_id] = user.id
      redirect_to root_url
    end
  
    def destroy
      session[:user_id] = nil
      redirect_to root_url
    end
  </code></pre>
  
  <p><strong>application_controller.rb</strong></p>
  
  <p>I had to comment this out because I kept getting InvalidAuthenticityToken errors which cost me the other half of my day.  A bit more on that <a href="https://github.com/intridea/omniauth/issues/237#issuecomment-908732">here</a>.</p>
  
  <pre><code>  # protect_from_forgery with: :exception
  </code></pre>
  
  <p><strong>Facebook settings</strong></p>
  
  <ul>
  <li>App domain: <code>myapp.dev</code></li>
  <li>Canvas URL: <code>http://myapp.dev</code></li>
  <li>Secure Canvas URL: -- blank -- if https is specified, I get <em>webpage is unavailable</em></li>
  </ul>
  
  <p>Please help before I start flipping desks.  :)</p>