Added secure headers

Enabled X-Frame-Options where applicable. Client needs to be framed so
is excepted. For now no CSP, we need to check first what exact features
we need before we enable that.