Header always set X-Frame-Options "SAMEORIGIN"