Remove X-Frame-Options

This option is now obsolete in the standards and browsers are complaining.
This needs to move to be a CSP header but this is hard to do from outside
the app (since it has to be 'merged' with the app's existing CSP).

fixes #596

src/test/database-test.js

@@ -412,7 +412,6 @@ describe('database', function () {
             oldConfig: null,
             newConfig: null,
             memoryLimit: 4294967296,
-            xFrameOptions: 'DENY',
             sso: true,
             debugMode: null,
             robotsTxt: null,
@@ -993,7 +992,6 @@ describe('database', function () {
             oldConfig: null,
             updateConfig: null,
             memoryLimit: 4294967296,
-            xFrameOptions: 'DENY',
             sso: true,
             debugMode: null,
             robotsTxt: null,
@@ -1028,7 +1026,6 @@ describe('database', function () {
             oldConfig: null,
             updateConfig: null,
             memoryLimit: 0,
-            xFrameOptions: 'SAMEORIGIN',
             sso: true,
             debugMode: null,
             robotsTxt: null,