Add X-Content-Type-Options and X-XSS-Protection headers