Fix bug 856124: Use Django's X-Frame-Options middleware.

This does the following things:

* Enable the middleware, with the default setting (which is SAMEORIGIN)
* Remove places where we've hacked in code just to send a SAMEORIGIN header value.
* Apply Django's decorators as needed to handle cases where we don't want SAMEORIGIN.
* Clean up the places where we still manually set the header, by making sure it matches what the middleware looks for when deciding whether to add it.