security: clean up the policy, add docs

[monkeyiq]

Instead of setting the header all over the place, use a new Security class to set that policy in code in one place. That uses a new config.php setting to provide the default choice and there are docs for that new setting. This should make it clean to issue a 'none' value and disable it in the web server configuration for sites which do not wish to use the default sameorigin policy or wish to tighten it up to a 'deny'.