code: function xframeFactory(options) {
    options = options || {};
  
    var str = 'DENY';
    if (isString(options)) {
      str = options;
    } else {
      if (options.sameOrigin) {
        str = 'SAMEORIGIN';
      }
      if (options.allow) {
        if (options.sameOrigin) {
          throw new Error('Cannot specify both ALLOW-FROM and SAMEORIGIN');
        }
  
        str = 'ALLOW-FROM ' + options.allow;
      }
    }
  
    return function xframe(req, res, next) {
      res.setHeader(HEADER, str);
      next();
    };
  }
docs: xframe() //deny xframe({ sameOrigin: true }) xframe({ allow: 'http://example.domain' }) xframe(rawStr)