Add Content-Security-Policy and X-Frame-Options headers