Issue #2514136 by pwolanin, David_Rothstein, Fabianx, greggles: Add default clickjacking defense to core