BUG Prevent clickjacking in CMS and Security controllers (fixes #2215)

Haven't added a test, since its kind of straightforward, right? We don't check for correct `Content-Type` headers etc in CMS responses either.