Output X-Frame-Options and X-Content-Type-Options response headers

Output X-Frame-Options response header.
And add "X-Content-Type-Options: nosniff" for JSON.