Extra security headers without a home

I would set it to this and commented out by default:
```
# add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' https://www.google-analytics.com;";
```