Review usage of _block_framing() for clickjacking prevention

[simonw]

We use that to avoid clickjacking in a bunch of places but it's not particularly consistent and could do with a review.