add automatic clickjacking protection