spring magic

web/src/main/java/lcsb/mapviewer/web/config/SpringSecurityConfig.java

@@ -88,6 +88,7 @@ public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
         .and()
         .cors().disable() // is managed by CORSFilter
         .csrf().disable()
+        .addFilterAfter(new XFrameFilter(), BasicAuthenticationFilter.class)
         .addFilterAfter(new CacheFilter(), BasicAuthenticationFilter.class)
         .addFilterAfter(new CORSFilter(), BasicAuthenticationFilter.class);
   }