Contrib: Issue #3411241: Expand ConverterCommand documentation to make it...

Contrib: Issue #3411241: Expand ConverterCommand documentation to make it easier to run - automatic_updates@183876fb

Closes #3411111

core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php

@@ -123,8 +123,10 @@ public function onRespond(ResponseEvent $event) {
     // different from the declared content-type, since that can lead to
     // XSS and other vulnerabilities.
     // https://owasp.org/www-project-secure-headers
-    $response->headers->set('X-Content-Type-Options', 'nosniff', FALSE);
-    $response->headers->set('X-Frame-Options', 'SAMEORIGIN', FALSE);
+    $response->headers->set('X-Content-Type-Options', 'nosniff');
+    if (!$response->headers->has('X-Frame-Options')) {
+      $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
+    }
 
     // If the current response isn't an implementation of the
     // CacheableResponseInterface, we assume that a Response is either