Prevent click-jacking

Use X-Frame-Options to indicate that this shouldn't allow embedding
within an iframe.