Add `X-Frame-Options: DENY` header by default, see #376