If you use JIRA with Apache webserver and mod_jk using https, I found the Activity Steams stopped working. JIRA uses an IFrame to display the Activity Stream. When the URL was pasted into a new browser tab it worked. After investigating I found it to be X-Frame-Options in the header to prevent Clickjacking. Sure enough JIRA is setting them to DENY.
A simple fix was to add this the the apache config.
Header always set X-Frame-Options SAMEORIGIN