FWIW, this [middleware is already setting X-Frame-Options: Deny](https://github.com/jsocol/commonware/blob/master/commonware/response/middleware.py#L4), unless the response otherwise supplies it.