X-FRAME-OPTIONS header syntax should be all caps

Example: Allow-From should be ALLOW-FROM

I'll submit a patch tomorrow for this.

RFC Spec: https://tools.ietf.org/html/rfc7034

2.1. Syntax

The header field name is:

X-Frame-Options

There are three different values for the header field. These values
are mutually exclusive; that is, the header field MUST be set to
exactly one of the three values.

DENY
A browser receiving content with this header field MUST NOT
display this content in any frame.

SAMEORIGIN
A browser receiving content with this header field MUST NOT
display this content in any frame from a page of different origin
than the content itself.

If a browser or plugin cannot reliably determine whether or not
the origin of the content and the frame are the same, this MUST be
treated as "DENY".

Please note that current implementations vary on the
interpretation of this criteria. In some, it only allows a page
to be framed if the origin of the top-level browsing context is
identical to the origin of the content using the X-Frame-Options
directive; in others, it may consider the origin of the framing
page instead. Also see Section 2.3.2.2 for more details on the
nesting of frames and variations in the handling of this header
field by different browsers. In addition, refer to Section 4,
paragraph 2 for the resulting potential security problems.

ALLOW-FROM (followed by a serialized-origin [RFC6454])
A browser receiving content with this header MUST NOT display this
content in a frame from any page with a top-level browsing context
of different origin than the specified origin. While this can
expose the page to risks by the trusted origin, in some cases, it
may be necessary to allow the framing by content from other
domains.