Adding Header
Set Content-Type to application/json and charset to utf-8 to tell the browser how to handle the response
Lock traffic on https  for 1 day (86400 seconds) by Strict-Transport-Security
Forbid the browser to load scripts from another domain by Content-Securty-Policy
Last ones were adopted by Talenka's Pull Request for ZeroBin: https://github.com/sebsauvage/ZeroBin/pull/70