Add X-Frame-Options to prevent clickjacking
Bump version to 9.4.11
Bump version to 9.4.11-dev