tell Rack::Protection to set X-Frame-Options to SAMEORIGIN
add changelog entry

[ci skip]
Merge pull request #638 from opf/feature/x_frame_options_header