I finally got this to work! I wound up adding content security policy to web.config (I'm hosted by IIS). Thanks to Groc.

  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Frame-Options" />
        <add name="Content-Security-Policy" value="frame-ancestors 'self' https://www.Example.com;" />
      </customHeaders>
    </httpProtocol>