Move cors.X_FRAME_OPTIONS to security.X_FRAME_OPTIONS and add false option

modules/setting/cors.go

@@ -17,13 +17,11 @@ var CORSConfig = struct {
 	MaxAge           time.Duration
 	AllowCredentials bool
 	Headers          []string
-	XFrameOptions    string
 }{
 	AllowDomain:   []string{"*"},
 	Methods:       []string{"GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
 	Headers:       []string{"Content-Type", "User-Agent"},
 	MaxAge:        10 * time.Minute,
-	XFrameOptions: "SAMEORIGIN",
 }
 
 func loadCorsFrom(rootCfg ConfigProvider) {