Fixed #21. ALLOW-FROM is added to XFrameOptionsPlugin.

This PR addresses ALLOW-FROM not included in our plugin according to
X-Frame-Options on MDN. We also follow the recommendation and
(https://bugzilla.mozilla.org/show_bug.cgi?id=836132#c28). We will
reject values  with colon and values without proper http/s prefix.

Furthermore, some functional tests have been written to test
XFrameOptionsPlugin.