Base on an older discussion, I got around the X-Frame-Option limitation by using the client-side redirect that forces the top parent window to go to the confirmation url.
$confirmation_client_load = <<< CONFIRMATION_CLIENT_LOAD
CONFIRMATION_CLIENT_LOAD; echo $confirmation_client_load;Not sure if there’s a more elegant solution, but it works for me for now.