remove x-frame-options from responses