Add X-FRAME-OPTION header to admin app

We should only let ourselves be able to host this app in a frame. No one
should be able to click jack us.