update xtend
fix clickjack