Add headers to make attacking the site harder

Add httponly flag to session cookie and X-Frame-Options,
Content-Security-Policy and Content-Type header with default charset.
These are all easy measures to help protect against XSS and exfiltration
attacks.

Bug: 71624
Change-Id: Ie89c5a9ac914d7c62d358cfa9379766bdc467af8