add user config option for X-FRAME-OPTIONS

allow developer to overwrite default value using hive key