trying to set a response header based on the referer

ne and then are not valid TCL commands. Also, there's no need to check if the variable is an empty string if you are looking for an explicit string. Give this a try:

when HTTP_REQUEST {
    set referer_host [URI::host [HTTP::header value Referer]]
}

when HTTP_RESPONSE {
    if {$referer_host contains "lbl.gov"}{
        HTTP::header insert X-Frame-Options "ALLOW-FROM $referer_host"
    }
    else {
        HTTP::header insert X-Frame-Options "SAMEORIGIN"
    }
}