Question: I have a service with a content observer watching the calendar provider and there are some instances where i need to stop the service so the observer's `onchange` does not get called when adding an event and then restart the service when it is added.

In my activity I use `stopService(new Intent(context,Service.class));` to stop the service then I start it up again later on trying to avoid the onchange call when the provider gets changed but it does not appear the service gets stopped because the onchange still gets called causing force closes in my database because my query in my service cant find the event yet.

so how can i get around this problem?

Answer: 
Clicking on the widget needs to open a pop-up window containing a new page -- an iframe is not good enough, it must be a new window -- which is entirely under the control of your web application. Confirm the action, whatever it is, on that page.

Yes, this is somewhat inelegant, but the present Web security architecture doesn't give you any better options.
I think I understand what you're doing. You want to allow any site to iframe your widget, thus an attacker has complete control of the parent's source code and can create clickjacking routines to force users to click the widget.

So the iframe would be able to employ a CSRF token, as it should, which will protect from this type of attack so long as the parent frame is unable to read the token.

Clickjacking, as I am sure you know, is a completely different type of attack than CSRF and needs a different defense.

Really, if the widget is super important than implement 2-phase authentication. Use <http://twilio.com> to call the user and have him input a pin. Or send an email to the user with a verification link. Or ask the user to verify the action next time the user logs into your widget's website. 

If you had control of the parent frame, then you would have more options. It would then be a XSS protection matter. 

Update after the correct answer has been selected
-------------------------------------------------

So my approach to protecting against clickjacking is a bit overboard. Looks like it can be protected using a popup window with a confirmation action.