Just change this to use the default setting of DENY via `helmet.xframe()` because nothing should need to frame popcorn.webmaker.org