tell Rack::Protection to set X-Frame-Options to SAMEORIGIN

fixes https://www.openproject.org/issues/1719