Rough-draft package for security-related http headers.
Serve runtime config from file when CSP disallows inline scripts.

Also tweak SecurityHeaders API.