Set X-Frame-Options only on pages that require login