We never need no-cache="set-cookie".
Send CSP headers, change Toadlet API a bit (but back compatible).
Use sendReplyHeadersStatic()
Doh, fix CSP headers.
Fix frames