allow multiple x-frame domains

requested by @alberto.noronha