use hood to add security headers

- adds CSP, X-Content-Type-Options: nosniff
- adjusts HSTS and X-FRAME-OPTIONS
- use proxySecure middleware