use hood to add security headers

- adds CSP, X-Content-Type-Options: nosniff
- adjusts HSTS and X-FRAME-OPTIONS
- use proxySecure middleware
Merge pull request #4012 from seanmonstar/3271-csp

CSP headers