BUG Prevent clickjacking in CMS and Security controllers (fixes #2215)