Remove double ALLOW-FROM from X-Frame-Options header.

The interface documentation for getAllowFromValue states: Gets the value for ALLOW-FROM excluding the ALLOW-FROM.