Lazily load SecurityHeadersConfig

The config isn't loaded until the filter is actually used. Fixes #2967.