So, in the context of this discussion, why don't the browsers make X-Frame-Origin: DENY the default behavior?????