Proof of concept of ignoring x-frame-options for sign-in webui.

chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.cc

Index: chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.cc
===================================================================
--- chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.cc	(revision 248093)
+++ chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.cc	(working copy)
@@ -37,6 +37,7 @@
 #include "chrome/common/extensions/extension_constants.h"
 #include "chrome/common/extensions/mime_types_handler.h"
 #include "chrome/common/render_messages.h"
+#include "chrome/common/url_constants.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_process_host.h"
@@ -591,6 +592,13 @@
     }
   }
 
+  if (request->first_party_for_cookies().SchemeIs(chrome::kChromeUIScheme) &&
+      request->first_party_for_cookies().host() == chrome::kChromeSigninHost) {
+    net::HttpResponseHeaders* response_headers = request->response_headers();
+    if (response_headers->HasHeader("x-frame-options"))
+      response_headers->RemoveHeader("x-frame-options");
+  }
+
   prerender::URLRequestResponseStarted(request);
 }