add header X-Frame-Options: SAMEORIGIN