Add Frame Security Options header

Signed-off-by: Norv <a.w.norv@gmail.com>
obExit actually doesn't get called for ajax calls
Add helptext.

Signed-off-by: Norv <a.w.norv@gmail.com>
Merge pull request #390 from norv/csp

X-Frame Options header