code: public static void setXFrameOptions (@Nullable final EXFrameOptionType eType, @Nullable final ISimpleURL aDomain)
    {
      if (eType != null && eType.isURLRequired ())
        ValueEnforcer.notNull (aDomain, "Domain");
  
      if (eType == null)
      {
        removeResponseHeaders (CHttpHeader.X_FRAME_OPTIONS);
      }
      else
      {
        final String sHeaderValue = eType.isURLRequired () ? eType.getID () +
                                                             " " +
                                                             aDomain.getAsStringWithEncodedParameters ()
                                                           : eType.getID ();
        setResponseHeader (CHttpHeader.X_FRAME_OPTIONS, sHeaderValue);
      }
    }
docs: The X-Frame-Options HTTP response header can be used to indicate whether or
  not a browser should be allowed to render a page in a &lt;frame&gt;,
  &lt;iframe&gt; or &lt;object&gt; . Sites can use this to avoid clickjacking
  attacks, by ensuring that their content is not embedded into other sites.
  Example:
  
  <pre>
  X-Frame-Options: DENY
  X-Frame-Options: SAMEORIGIN
  X-Frame-Options: ALLOW-FROM https://example.com/
  </pre>
  
  @param eType
  The X-Frame-Options type to be set. May not be <code>null</code>.
  @param aDomain
  The domain URL to be used in "ALLOW-FROM". May be <code>null</code>
  for the other cases.