Changes X-Frame-Options header from DENY to SAMEORIGIN.

This fixes problems with iframes not displaying their contents because the header was set to DENY. File upload wizards and other multi-page popup forms that use ajax post to a named iframe so they need to be displayed.

SAMEORIGIN is no less secure than DENY, as it will still protect against clickjacking and cross-site framing.
Fixes a bug with mismatched parentheses in function courses_fetch_courses.

I also removed the strtolower call because the group name strings are lowercase to begin with.
Ref #281 Fixed a few issues with the events draft csv importer. Cohorts wouldn't import from CSV files due to the string being used missing the 's' on the end of "cohorts", and the UPDATE sql syntax was incorrect, so updating existing draft events didn't do anything. Both of those issues are now resolved, and the recurring id is now populated in the `draft_events` table if it exists in the csv, or is associated with the "original event" id provided.
Merge branch 'develop' into feature-csv-col-mapper

* develop:
  Fixes a bug with mismatched parentheses in function courses_fetch_courses.
  Changes X-Frame-Options header from DENY to SAMEORIGIN.