Force X-Frame-Options

This is in response to Twitter adding SAMEORIGIN x-frame-options.