Add default-on security headers for bug 1017175