Fixed #21. ALLOW-FROM is added to XFrameOptionsPlugin. 

This PR addresses ALLOW-FROM not included in our plugin according to [MDN] (https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options?redirectlocale=en-US&redirectslug=The_X-FRAME-OPTIONS_response_header). We follow the recommendation that FF has taken recently [here](https://bugzilla.mozilla.org/show_bug.cgi?id=836132#c28). We will reject value with colon and value without proper http/s prefix.

Furthermore, some functional tests have been written to test XFrameOptionsPlugin,