Is the website where you are embedding this use SSL (i.e. url starts with https)? If not, I wonder if this is the issue you are encountering.
i ended up figuring it out after following enough breadcrumbs and half references across different posts here and stackoverflow
2. the url for the embedded report in tableau online is a different format. I thought it would be the URL that's exposed in the embed code under the share option. You need to use the link code instead