Sending HTTP X-FRAME-OPTIONS by default