add X-FRAME-OPTIONS to all but /provision