Add switch to deny bots access to the site.

Currenty switched off.
Use SAMEORIGIN for X-Frame-Options. File fields need it.