Merge "(bug 39180) Set x-frame-options='DENY' for api"