Add response headers for security improvements

- "X-Content-Type-Options: nosniff" for all responses
- "X-XSS-Protection: 1; mode=block" for HTML responses