Security fix

Prevent MIME-Type confusion and ClickJacking Attacks with headers.
Set session cookie to use HttpOnly.
Do not allow the indexing of directories.