add various headers and appengine congfigs to make https more secure

[mark-meyer]

This adds response headers and a change in the app.yaml config to address https issues.