Added HTTP headers to fend off some nasties.

Basic measures against click jacking and cross site scripting.