"X-Frame-Options" header set by Apache prevents opiframe from being used by RP

[aliaksander-samuseu]

Environment:
CentOS6.7/Ubuntu 14.04, Gluu CE 3.0.1/Gluu CE 3.1

Steps to reproduce:

1. Sent a request similar to below (you may need a valid session cookie for it to work):

GET /oxauth/opiframe HTTP/1.1
Host: idp.gsu.edu
Connection: close
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: http://oidc-js.site:5000/user-manager-sample.html
Accept-Encoding: gzip, deflate, sdch, br
Accept-Language: en-US,en;q=0.8
Cookie: csfcfc=eFL7H6eZ; session_state=f7e8e1d1-8d5d-4cb5-ac33-0e3dbf0111f4

Result:
Response contains "X-Frame-Options: SAMEORIGIN" header what prevents RP from using it in iframe as it should to be used per this spec
This happens because of this line added in 3.x to Apache's config:

        # Security headers
        Header always append X-Frame-Options SAMEORIGIN

Expected result:
No "X-Frame-Options" header in response from /oxauth/opiframe. Or header with a value allowing to use it in iframe at this origin.

[qbert2k]

GluuFederation/community-edition-setup@4a3029c