Add HSTS, security headers and new options in config.  ( bug 1018391 )

https://bugzilla.mozilla.org/show_bug.cgi?id=1018391

This adds three new config options:

# Disable HSTS? (set to 'true' to disable HSTS)
HSTS_DISABLED='true'

# Use Deny settings for X-Frame headers?
# set to 'true' to disable X-frames-options denial
DISABLE_XFO_HEADERS_DENY='false'

# Use default XSS protection?
# set to 'true' to disable IEXSS protection
IEXSS_PROTECTION_DISABLED='false'

This will allow us to turn these security headers on and off easily without deploying a new version.