Refuse to display Bolt in an iframe, to prevent possible clickjacking. See #2197.

Thanks, @narendrabhati