Add Content-Security-Policy header

This would mitigate any possible XSS attack since the browser won't execute any Javascript.