Don't require X-Frame-Options header

[Seirdy]

• Microsoft's Webhint.io flags this header, recommending to instead use a CSP
• MDN has a notice claiming that this header is obsoleted by the CSP header
• On caniuse.com, the number of users who use a browser supporting X-Frame-Options but not supporting the CSP header is extremely small.

X-Frame-Options shouldn't be a requirement nowadays, since it's a security measure only relevant on browsers that no longer receive security updates.

[andersju]

Updated; thank you!