add `X-Frame-Options` header to html responses