[Server settings] 'X-Frame-Options' should not be 'ALLOWALL'