added click-jacking code