Major Description
The configuration attribute in the controller/site-conf.xsd is "x-frame-option" while the Controller reads "x-frame-options".
I will change this to be "x-frame-options" in controller/site-conf.xsd also because the Header value is "X-Frame-Options".
I also propose to introduce another configuration token "none" to be able to switch off this header value for the view, same mechanism as for strict-transport-security.
What do you think?