voorsteven: deny access to .git; prevent MSIE misinterpret; enable X-XSS-Protection; prevent frame-clickjacking attacks