Move X-Frame-Options header from index.php to Response object in Controller::before().
Change direct header() calls to Response object headers(), status(), or send_file().
Merge pull request #301 from shadlaws/headers

Headers