Set X-Frame-Options to DENY for transactions

We should explicitly deny framing of any kind for pages that link to external transactions. This makes clients that understand it behave more securely in these circumstances.