add X-FRAME-OPTIONS to all but /provision
Merge pull request #109 from mozilla/x-frame

add X-FRAME-OPTIONS to all but /provision