Moved security headers into web.config
Changes following code review