Anti-XSRF helpers should also forbid clickjacking attacks.
AntiforgeryToken() will now by default adds the X-FRAME-OPTIONS to prevent clickjacking attacks.
Users can opt-out by using the flag SuppressXFrameOptionsHeader on AntiForgeryConfig.