security improvements [?h]

[noamoss]

based on https://sitecheck.sucuri.net/results/https/admin.equality.org.il:

• [ ] Missing security header for ClickJacking Protection. Alternatively, you can use Content-Security-Policy: frame-ancestors 'none'.
• [ ] Missing security header to prevent Content Type sniffing.
• [ ] Missing Strict-Transport-Security security header.
• [ ] Missing Content-Security-Policy directive. We recommend to add the following CSP directives (you can use default-src if all values are the same): script-src, object-src, base-uri, frame-src

[noamoss]

hey @akariv, please add time estimation when possible.