Fixes #6098: Sends anti-clickjacking header