Add test case for X_FRAME_OPTIONS_EXCLUDE_URLS