Specify response header X-Frame-Options SAMEORIGIN for generated pages
Merged #166 "Fix XRF vulnerability"