Modified to use proper, unprefixed Content-Security-Policy header
Added Strict-Transport-Security