Added X-Frame-Options and Access-Control-Allow-Origin

This will mimic what the frontend now does and ensure that cachelite do not allow a more permissive X-Frame-Options
1.3 Release notes