X-Frame-Options: DENY. Fix #428