prevent the LMS/CMS from being renderable in an iframe

@dianakhuang @ormsbee not sure who to ask here

I can't think of an automated test for this. Basically, this just makes sure that someone can't embed the LMS/CMS in an iframe.