Add click hijacking protection to default.conf