Add X-Frame-Options DENY in middleware.