apache2 headers: set set X-Content-Type-Options: "nosniff", X-XSS-Protection: "1; mode=block", X-Content-Security-Policy "script-src 'self'. Closes #6