Update app.py

app.py

@@ -156,7 +156,6 @@ async def secure_origin(request: Request, call_next):
     if path in _HF_PREVIEW_PATHS:
         # X-Frame-Options cannot express an allowlist. Omit it only on these
         # harmless GET endpoints and use CSP's exact parent-origin allowlist.
-        response.headers.pop("X-Frame-Options", None)
         response.headers["Content-Security-Policy"] = _HF_FRAME_ANCESTORS
     else:
         response.headers["X-Frame-Options"] = "SAMEORIGIN" if path.startswith("/admin") else "DENY"