update for anti click jacking
we reset headers in AuraFrameworkServlet, set SAMEORIGIN again
also update tests
@bug W-1969174@
@rev fabbott@
@rev tbliss@
Merging origin/lin/master-pending/anti-click-jacking into master