add support for setting X-Frame-Options: SAMEORIGIN

is this better?
```
if (xframe == null) xframe = 'SAMEORIGIN';
if (xframe === true) xframe = 'DENY';
```

if someone wants to set `ALLOW FOR uri`, just do it self, or add some support?