tell Rack::Protection to set X-Frame-Options to SAMEORIGIN
add changelog entry

[ci skip]