Add X-Frame-Options DENY to group/profile/forgot-password forms.

This covers the only POST actions that currently exist in the
codebase, but perhaps a whitelist approach would be better in order to
prevent future additions from being missed?