set default HTTP headers to enhance security