#996: Send X-Frame-Options header to prevent clickjacking attacks