added protection againt clickjacking
Add the X-Frame-Options header in the base controller.