Add Security Headers

Added two Security Headers.

* Added `x-frame-options: SAMEORIGIN` to prevent websites to include an iframe of the site. This limits the ability of other sites to perform clickjacking attacks. This still allows developers to put iframes on their site that have the same origin.

* Added `x-xss-protection: 1; mode=block` to enable XSS protection on the browser.