Hi Tim, I see that you asked for more feedback at the end of your post, though I know it’s been quite a while. The conflict between Theme Composer and Salesforce Session Setting you mention is just that if you enable clickjack protection for Visualforce Pages with disabled headers will encounter the cross-origin error. The Theme composer is a Visualforce page (in the Skuid namespace), and I believe its header is always disabled, so it can be affected by settings like these.
