X-Permitted-Cross-Domain-Policies support

This PR implements the `X-Permitted-Cross-Domain-Policies` header with the default value of `none`. I reviewed the discussion in #88 while working through this. Given the discussion around versioning, it seemed like `none` was an ok default given the impending major version bump.

In the process of working through this, I found that `X-Download-Options` wasn't documented in the README, the 2nd commit addresses that.