Fix header typo
Add X-Frame-Options header, requires review
Merge pull request #25 from rschiang/fix-ajax

X-Frame-Options header