don't send "X-Frame-Options:sameorigin" header