Add CSP and other security headers