CSP headers

- use hood to add security headers
- adds CSP, X-Content-Type-Options: nosniff
- adjusts HSTS and X-FRAME-OPTIONS

fixes #3271