added initializer for secure_headers

To avoid those warnings in browsers console about violations in Content Security Policy.