Removed strict transport security policy from security config; fixed issue with xframe options header only returning deny;