Should we also have a report for the case where no X-Frame-Options header is set? I think Invalid means that you have the header but it is not correct.