Set X-Frame-Options response header to allow same origin