provision: move X-Frame-Options header out of {% if ssl-enabled %} Because it's not a HTTPS-only feature, let's enable it always.