Changes X-Frame-Options header from DENY to SAMEORIGIN.

This fixes problems with iframes not displaying their contents because the header was set to DENY. File upload wizards and other multi-page popup forms that use ajax post to a named iframe so they need to be displayed.

SAMEORIGIN is no less secure than DENY, as it will still protect against clickjacking and cross-site framing.