fixed typo
Add CSP headers & remove inline styles

[#75]
Disable iframe, add X-XSS-Protection header

[#75]