Add security headers to server

[liamkirsh]

INSPIRE Nightly is currently missing the following headers:

• X-Frame-Options: should be set to "SAMEORIGIN" if we expect pages to be framed on our server, or DENY if the pages will never be framed. Otherwise the website is vulnerable to clickjacking. http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx
• X-XSS-Protection: should be set to "1; mode=block" to forcibly enable the XSS filter in certain web browsers and prevent page rendering if an attack is detected. https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#X-XSS-Protection
• X-Content-Type-Options: should be set to value "nosniff" to prevent the browser from interpreting files as something else than the declared content type. https://msdn.microsoft.com/en-us/library/gg622941(v=vs.85).aspx

[kaplun]

Not sure about the status of this ticket.

[jmartinm]

For this we can use Flask-Talisman, see https://github.com/inspirehep/inspire-next/issues/2987