notify user of SAMEORIGIN restriction

[mfrederickson]

In javascript console after adding an iframe for google:

Refused to display 'https://www.google.com/' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.