Add X_FRAME_OPTIONS_EXCLUDE_URLS setting

This setting provides means to whitelist certain pages that are expected to be hosted in an `<iframe>` while still protecting the rest of the site.