don't use the X-Frame-Options header by default