x_frame_options now accepts confiogurations only for deny and allow-from modes