add CSP and X-Frame-Options to default Apache config