Use X-Frame-Options SAMEORIGIN instead of DENY

Previously Spring Security prevented any content from being framed
using the X-Frame-Options DENY header. This is the default behavior
with Java Configuration to help protect sites from clickjacking. The
header prevented the h2 admin UI from being rendered sine it uses frames.

Now the Security configuration has been updated to use the
X-Frame-Options SAMEORIGIN header which allows framing the content
but only if it comes from the same domain. This allows the h2 admin
Servlet to render its UI.
Merge pull request #22 from rwinch/xframes

Use X-Frame-Options SAMEORIGIN instead of DENY