require `X-Frame-Options: SAMEORIGIN` for clickjack prevention