add nginx response header to fix Cross-Frame Scripting (XFS) vulnerability.