add frame busting js to patch vulnerability