New FrameGuard middleware sends SAMEORIGIN X-Frame-Options header on each response by default.
Fix type-hint.