X-Frame-Options header in response is customizable