Added CSP/X-Frame-Options/Secure-Transport etc headings and cleaned up some inline javascript