require `X-Frame-Options: SAMEORIGIN` for clickjack prevention
Declare rack-protection dependency explicitely
Merge pull request #1585 from raul/prevent-clickjacking

Require `X-Frame-Options: SAMEORIGIN` for clickjack prevention