selectively adding this header to the only document where it's appropriate.  This is a blacklist approach rather than whitelist (if pages are added in the future, they will not have these headers by default), but this seems find given we will add tests for new static pages added, and those tests include `X-Frame-Options` checking.