[REVIEW] Bugfix/540 clickjacking protection

Ah ok, indeed we're lacking a (front) controller. Ideally the controller would be created by the service container and have all it's dependencies injected.