Use helmet, and set options for XSS, XFO for bug 1017175