The instance this page embeds sets ALLOWED_HOSTS to its own address, so the browser refuses to frame it here and the widget document never runs.