Add x-frame-options header to all transaction routes