adds security headers
removes inline scripts