Added secure headers

Enabled X-Frame-Options where applicable. Client needs to be framed so
is excepted. For now no CSP, we need to check first what exact features
we need before we enable that.
Merge pull request #24 from Factlink/add-clickjacking-protection

Added secure headers