Add default security headers.

[mschurr]

Need to make sure we are setting sensible defaults for security headers:

X_XSS_PROTECTION("X-XSS-Protection"),
CONTENT_SECURITY_POLICY("Content-Security-Policy"),
STRICT_TRANSPORT_SECURITY("Strict-Transport-Security"),
PUBLIC_KEY_PINS("Public-Key-Pins"),
X_FRAME_OPTIONS("X-Frame-Options"),
X_CONTENT_TYPE_OPTIONS("X-Content-Type-Options"),
REFERRER_POLICY("Referrer-Policy");