Implement HTTP Security Headers (XCTO, XFO, XXSSP)

[freddyb]

This bug is about implementing basic HTTP security headers.

• X-Content-Type-Options: nosniff (also known as XCTO)
• X-Frame-Options: DENY (or SAMEORIGIN, also known as XFO)
• X-XSS-Protection (also known as XXSSP)

Doing so comes at no cost and will certainly not break anything, given how the app currently works.

[freddyb]

XFO is #225. X-XSS-P should be enabled, if I read this line correctly, but it isn't :-( XCTO is #226

[pmac]

These are all done. Thanks!