add apache reponse header to fix XFS vulnerability

XFS stands for Cross-Frame Scripting