disables embedding the site in any frames, which can bypass some of the security mechanisms reg. cross site scripting