Add X-Frame-Options header to admin app

We should only let ourselves be able to host this app in a frame. No one
should be able to click jack us.