MAGETWO-43510: x-frame-options missing from setup

- using framework to add header

Author: eddielau

setup/index.php

@@ -28,6 +28,4 @@
 $handler = new \Magento\Framework\App\ErrorHandler();
 set_error_handler([$handler, 'handler']);
 
-header('X-Frame-Options: SAMEORIGIN');
-
 \Zend\Mvc\Application::init(require __DIR__ . '/config/application.config.php')->run();

setup/src/Magento/Setup/Module.php

@@ -49,6 +49,7 @@ public function onBootstrap(EventInterface $e)
                 $headers->addHeaderLine('Cache-Control', 'no-cache, no-store, must-revalidate');
                 $headers->addHeaderLine('Pragma', 'no-cache');
                 $headers->addHeaderLine('Expires', '1970-01-01');
+                $headers->addHeaderLine('X-Frame-Options: SAMEORIGIN');
             }
         }
     }