follow url changes
test against x-frame-options SAMEORIGIN and DENY