Add X-Frame-Options header to all responses.