[BUG BASH] missing protection against ClickJacking