fix: feat: X-Frame-Options as config option (not in GUI available; same for X-Content-Type-Options & X-XSS-Protection