Embedding an AppEngine-hosted web app via IFRAME

This doesn’t look like a Discourse problem. If you fix the URL you’re embedding to not cause a 307, everything will probably work a lot better. Interestingly, the “307 Internal Redirect” is reportedly issued when Chrome is asked to load a HTTP resource for a domain for which it has an HSTS policy active. However, in your case the headers suggest that it’s already a HTTPS URL, so presumably there’s also other cases where Chrome does the same thing. Either way, though, this isn’t a problem with Discourse, it’s a browser/embedded site problem.