added mitigation to clickjacking attacks on iframes