Security headers

This breaks any crypton apps that use any remote content or script. You can override the headers with the addition of an env var 'CRYPTON_LUSCA_CONF'. 

I do not know if we need to add some kind of CSRF middleware as well.