title: django admin change page add foreign key error: server refuses to connect
body: <p>I have a model called &quot;press&quot; with a field for &quot;lab&quot;, which is another model. on the admin change page for an object in &quot;press&quot;, I can choose the &quot;lab&quot; from a list, or click the green plus sign to add a new one. In development, this works fine.</p>
  <p>the choice box:
  <a href="https://i.stack.imgur.com/KgWd1.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/KgWd1.png" alt="enter image description here" /></a></p>
  <p>after clicking the 'add' sign IN DEVELOPMENT
  <a href="https://i.stack.imgur.com/URR4i.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/URR4i.png" alt="enter image description here" /></a></p>
  <p>looks good. BUT, on my actual site, this is what happens. the red is the name of the server/root url of the site
  <a href="https://i.stack.imgur.com/LtKty.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LtKty.png" alt="enter image description here" /></a></p>
  <p>This is not the only time this happens. It is every 'plus' button that adds a new item to a foreign key field.</p>
  <p>the link on the button in this case was
  dev: http://.../admin/press/lab/add/?_to_field=id&amp;_popup=1
  actual: https://.../admin/press/lab/add/?_to_field=id&amp;_popup=1</p>
  <p>everything there looks ok.</p>
  <p>ALSO on the actual site, if i click 'add' on the left menu, it works fine.
  <a href="https://i.stack.imgur.com/gmj8T.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/gmj8T.png" alt="enter image description here" /></a></p>
  <p>in that case, the link is: https://.../admin/press/lab/add/</p>
  <p>is the problem because the first case is a popup? or it doesn't like /?_to_field=id
  any ideas?</p>
  <p>EDIT. i think it's an x-frame options issue. Mine is set to &quot;DENY&quot; in settings.py, because that was advised for keeping things secure. Changing it to &quot;SAMEORIGIN&quot; fixed everything. But, that seems to go against the recommended usage. is there a way to keep things secure and still have the functionality?</p>