Express middleware for xframe header