Require `X-Frame-Options: SAMEORIGIN` for clickjack prevention

Standard [clickjacking](http://en.wikipedia.org/wiki/Clickjacking) prevention, props to @tmaher.