send X-Frame-Options header with value "DENY"

pom.xml

@@ -316,6 +316,11 @@
 			<groupId>io.dropwizard.metrics</groupId>
 			<artifactId>metrics-json</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>io.dropwizard.modules</groupId>
+			<artifactId>dropwizard-web</artifactId>
+			<version>1.5.0</version>
+		</dependency>
 
 		<dependency>
 			<groupId>javax.xml.bind</groupId>

src/main/java/com/commafeed/CommaFeedApplication.java

@@ -61,6 +61,8 @@ import io.dropwizard.server.DefaultServerFactory;
 import io.dropwizard.servlets.CacheBustingFilter;
 import io.dropwizard.setup.Bootstrap;
 import io.dropwizard.setup.Environment;
+import io.dropwizard.web.WebBundle;
+import io.dropwizard.web.conf.WebConfiguration;
 
 public class CommaFeedApplication extends Application<CommaFeedConfiguration> {
 
@@ -96,6 +98,15 @@ public class CommaFeedApplication extends Application<CommaFeedConfiguration> {
 			}
 		});
 
+		bootstrap.addBundle(new WebBundle<CommaFeedConfiguration>() {
+			@Override
+			public WebConfiguration getWebConfiguration(CommaFeedConfiguration configuration) {
+				WebConfiguration config = new WebConfiguration();
+				config.getFrameOptionsHeaderFactory().setEnabled(true);
+				return config;
+			}
+		});
+
 		bootstrap.addBundle(new AssetsBundle("/assets/", "/", "index.html"));
 		bootstrap.addBundle(new MultiPartBundle());
 	}