New FrameGuard middleware sends SAMEORIGIN X-Frame-Options header on each response by default.