Set X-Content-Type-Options and X-Frame-Options by backend.

Make sure nginx config does not duplicate these headers