adding security policies

content security policy to limit domains that code can be loaded from, also blocks inline css and js
frame options prevents the page from being presented in an iframe on a different site (often used for click jacking)
XSS protection is the internet explorer version of content security policy that uses IE's safe and threat lists (IE only)
Content Type Options prevents attacks that store code in another file type to get past browser security (IE only)