Add CORS and other metadata configuration

Content Security Policy, Signed Cookies, Encrypted Cookies,
Clickjacking Protection, External Redirects Detection, Forced HTTPS/SSL
Handling, Flexible HTTPS/SSL Handling, Disable Content Type Sniffing