fixed typo in noframes header

Correct header name is X-Frame-Options not X-Frames-Options as stated in [the docs](https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options)